If your business runs on Microsoft 365 — and most do — you might assume that Microsoft is keeping your data safe. After all, you're paying them every month, and the service is always available. Surely it's all backed up somewhere?
Here's the thing: Microsoft's responsibility is to keep the service running. That means the servers stay up, the applications are accessible, and the infrastructure is maintained. What it doesn't mean is that your specific data — your emails, your SharePoint files, your Teams conversations — is protected against loss.
What Microsoft actually protects
Microsoft provides a very solid infrastructure guarantee. Their data centres are redundant, their uptime is excellent, and if a data centre has a problem, your access is rerouted automatically. That's genuine and it's impressive.
What they don't do is protect your data from:
- Accidental deletion by a user
- Malicious deletion by a departing employee
- Ransomware encrypting or deleting your files
- Data loss when a licence is removed or an account is closed
- Mistakes during migrations or configuration changes
Microsoft even say so in their own documentation. They explicitly recommend using a third-party backup solution.
The retention window problem
Microsoft does have some built-in recovery options — deleted items can be recovered for up to 30 days in most cases. But these aren't a backup. If a file was deleted six weeks ago and nobody noticed until today, it's gone. If ransomware gradually encrypted files over several weeks, by the time you discover the problem the clean copies may already be outside the retention window.
What actually happens when data is lost
In our experience, the most common scenarios are:
- An employee leaves and their account is deleted — taking their emails and OneDrive files with them
- Someone accidentally deletes a SharePoint folder containing years of documents
- A ransomware attack encrypts files on OneDrive, which syncs the encrypted versions to the cloud
- A migration goes wrong and data is overwritten
None of these are covered by Microsoft's built-in protection beyond the short retention window.
What a proper backup looks like
A proper Microsoft 365 backup takes regular snapshots of your data — mailboxes, SharePoint, Teams, OneDrive — and stores them independently of Microsoft's infrastructure. It means you can restore a single deleted email from six months ago, or roll back an entire SharePoint site to how it looked before something went wrong.
Our backup solution covers the full Microsoft 365 suite and stores your data across three UK data centres — so it's geographically separated from whatever might have caused the problem in the first place. Automated daily backups, regular restore tests, and a clear report so you know it's working.
The bottom line
If your business relies on Microsoft 365 — particularly if you're in a sector where data retention matters (healthcare, finance, legal, education) — you need a backup that's independent of Microsoft. It's not expensive, it's not complicated to set up, and the alternative is finding out the hard way that the data you needed wasn't where you thought it was.
If you're not sure whether your 365 data is properly protected, get in touch — we'll review your setup and give you a straight answer.