Short answer? No - Microsoft 365 doesn’t back up your data in the way most businesses assume. It does keep your data available and the service running, but it doesn’t back it up in a way that allows recovery if data is deleted, encrypted or lost.
But this is a very common assumption, especially with SMEs. It’s easy to think that because your data is in the cloud, it’s safe, but in reality there are several responsibilities that fall to you.
In this guide we’ll explore what Microsoft does do, the four main ways SMEs lose data, and how you can close vulnerability gaps. Here’s what we’ll cover:
- What Microsoft protects, and what it doesn’t
- The four ways SMEs lose Microsoft 365 data
- What managed Microsoft 365 backup covers
- A case study
What Microsoft protects, and what it doesn’t
First let’s clarify exactly what is protected and what isn’t with default Microsoft 365 configurations.
Replication: keeps the service running
Microsoft replicates your data across its data centres to ensure availability, protecting you against hardware failure and outages. This doesn’t snapshot your data in a way that allows rollback if it’s deleted, corrupted or otherwise lost.
Recycle Bin & retention windows
Deleted items and retention windows hold things for a limited period, but after that they’re gone. And the windows are often shorter than people realise.
If you discover malicious or accidental deletions months after the fact, these will be beyond the retention windows and permanently lost as a result.
In explicit terms: Microsoft keeps the platform running and your data available, but backing up and recovering specific data is your responsibility.
The four ways SMEs lose Microsoft 365 data
Here are four of the most common ways SMEs lose data, covering everything from accidents to malicious actors.
- Accidental deletion: a mailbox, file, SharePoint site or something else is deleted and only noticed after the retention window has passed - making it irretrievable
- Ransomware or malware: files encrypted by these attacks sync to the cloud, overwriting the good copies - files being in the cloud offers no protection here
- Departed-employee data: when a leaver’s license is removed, their mailbox and files can be purged - if this is noticed after the retention window, it's lost
- Retention policy gaps and compliance: misconfigured or default retention policies rarely meet the requirements that sectors and contracts might demand
If you’re worried about any of these risks in your organisation, book a free consultation today and one of our team will talk you through potential risks and how to mitigate them.
What managed Microsoft 365 backup actually covers
Protecting your organisation against these vulnerabilities and ensuring ongoing access to your data in the case of accidental or malicious deletion involves a few steps:
- Independent, point-in-time backups: these should be held separately from Microsoft platforms so that you can restore to a moment before deletion or attack
- Full platform coverage: Exchange, SharePoint, OneDrive and Teams
- Granularity: recover a single email or file, or an entire site
- Retained for as long as you need: to ensure access whenever required, and compliance with contract terms where relevant
Taken together, these prevent your data ever being gone for good. Learn more about our data protection and recovery services here.
Microsoft 365 backup: don’t fall for the common traps
Microsoft 365 is a brilliant platform for SMEs, but despite misconceptions, protecting the data on it is your responsibility. Building and maintaining a full backup layer can be done internally, but handing it over to a professional, accountable partner frees up resources and brings peace of mind.
To review what’s actually protected in your Microsoft 365 and what isn’t, book a free consultation with our team. We’ll run through your configuration, vulnerabilities, and the steps you need to take to close the gaps.