“It's in the cloud, so it's backed up”
Email in Exchange Online, documents on OneDrive and SharePoint, chats and files in Teams: for many companies Microsoft 365 has become the place where everything lives. And because it is in the cloud, people assume that someone is backing it up. That is partly true, but not in the way you need on the day a folder disappears.
Who protects what: shared responsibility
In cloud services, protection is split between provider and customer, under what is known as the shared responsibility model. Microsoft ensures the availability and resilience of the service and the infrastructure: datacentres, redundancy, hardware failures. If a disk fails in one of its datacentres, your email does not notice.
Protecting the content, on the other hand, is largely up to you: deletions, mistakes, attacks and, above all, actions taken by people with legitimate access. If a user, an administrator or an attacker with valid credentials deletes data, as far as the service is concerned it is an authorised operation, carried out correctly.
What Microsoft 365 already has, and why it is not enough
The recovery tools exist and they are useful. However, they have time limits and sit inside the same service. The figures shown are for the default settings.
| What is already there | Why it is not enough | |
|---|---|---|
| Deleted email | In Exchange Online, deleted items remain recoverable for 14 days, which can be extended to 30 | Anyone looking for an email deleted two months earlier will not find it |
| SharePoint and OneDrive recycle bin | Keeps deleted files for 93 days | After that, the file can no longer be recovered from the bin, and anyone with the right permissions can empty it sooner |
| File versions | Let you go back to an earlier version of a document | Useful for undoing a mistaken edit; they remain tied to the file and to the same service |
| Retention policies | Retain content for the set period, even if the user deletes it | They have to be configured, are designed for compliance needs and sit in the same tenant |
| Deleted or unlicensed account | The mailbox and OneDrive remain recoverable for a retention period | Once that period ends they are deleted, along with all their content |
The common thread is this: retention and versions are useful, but they are not an independent backup. They sit in the same service and depend on the same admin credentials: whoever controls an administrator account can usually change them too.
Five situations where the recycle bin is not enough
- The deleted shared folder. A user accidentally deletes the quotes folder on SharePoint. The salesperson notices more than three months later, when they need to go back to a proposal: by then it has already been purged from the recycle bin.
- The ransomware that syncs. On a PC in the accounts department, ransomware encrypts the files in the folder synced with OneDrive. Sync does its job and carries the encrypted copies up to the cloud.
- The compromised administrator. With the credentials of an admin account, an attacker can delete data, empty recycle bins and change retention policies. All from the inside, with valid access.
- The employee who leaves. The licence is removed to save money and, months later, someone needs an email exchanged with a supplier: the mailbox and OneDrive are gone.
- The faulty script. An automated clean-up job with a badly written filter deletes far more items than expected, possibly across several mailboxes at once.
What to do, in order
- Decide what to protect and for how long: mailboxes, SharePoint sites, OneDrive, Teams, and for each one how far back you need to be able to go and how quickly you need it restored. These are the RPO and RTO described in the guide on RTO and RPO.
- Set up an independent backup, with copies kept outside the tenant, or at least where Microsoft 365 admin credentials cannot delete them. There are third-party solutions and services offered by Microsoft itself: either way, ask where the copies are kept, for how long, and who can delete them.
- Protect admin accounts with multi-factor authentication, keep their number down and do not use them for everyday email.
- Build backup into the leaver process: before removing a licence, check that the mailbox and OneDrive are covered by the backup or have been exported.
- Test a real restore: a whole mailbox or a SharePoint site, not just a single file. And measure how long it takes.
It is the same logic as the 3-2-1 backup rule: at least one copy kept apart from the original, on a different system, that an attack on the main system cannot reach.
The most common mistakes
- Mistaking retention for backup. Retention policies help, but they stay in the same tenant.
- Protecting only email. SharePoint, OneDrive and Teams often hold the most important documents.
- Using the same credentials for the tenant and the backup. Whoever compromises one can reach the other too.
- Never having done a restore. You find out how long it takes at the very moment you need it.
In short
Microsoft ensures that the service works; the content is largely yours to protect. The recycle bin, versions and retention have time limits and sit in the same tenant: to recover from a mistake discovered late, an attack or a deleted account, you need an independent backup, with MFA-protected administrators and tested restores.