Microsoft 365 backup: what businesses need to know

There’s a common assumption that because Microsoft 365 lives in the cloud, it must already be backed up. It’s an understandable one. Microsoft is a huge company with very resilient infrastructure. But it’s a misunderstanding of what Microsoft is responsible for, and it catches businesses out.

Who is responsible for what?

Microsoft’s approach is often described as a shared responsibility model. Microsoft is responsible for keeping the service itself available: the datacentres, the networks, the platform. You are responsible for the data you put in it and how it’s protected, including accidental deletion, malicious changes and the consequences of a compromised account.

Microsoft provides some helpful safety nets: recycle bins, version history and retention features. These are designed to help you recover from everyday mistakes. They are not the same as an independent backup, and their limits depend on your plan, your settings and how long ago something happened.

What can actually go wrong

• Accidental deletion. Someone deletes a folder, a mailbox or a Teams channel and doesn’t notice for weeks, by which time retention windows have passed.
• Malicious deletion. A disgruntled leaver, or an attacker with a stolen password, removes data on purpose.
• Ransomware. Files encrypted on a synced laptop are quietly synchronised to OneDrive, overwriting the good copies.
• Leavers. An account is deleted when someone leaves and their mail and files go with it.
• Compliance and disputes. You need an old email or document to resolve a dispute, and it’s no longer there.

None of these is exotic. They are everyday events for businesses of any size.

What a proper Microsoft 365 backup looks like

A good backup is an independent copy of your data, held outside your Microsoft 365 tenant, that you can restore from even if the original is gone. Look for the following:

• Coverage for Exchange mailboxes, OneDrive, SharePoint sites and Teams data
• Regular automatic backups, with clear visibility of when they last succeeded
• Retention that suits your needs, not just a default
• Granular restore: bringing back a single email or file, not just everything
• Protection from being deleted by the same account that is compromised
• Alerts when something fails

Backup is not the same as recovery

Having a backup product is only half of the story. The question that matters is: if something went wrong this afternoon, how quickly could you be working normally again, and how much would you lose?

That’s why testing matters. A backup you’ve never restored from is an assumption, not a safety net. Good practice is to test restores on a schedule and to write down who does what. Our guide on what a small business disaster recovery plan should include covers this in more detail.

Questions to ask your provider

1. Is our Microsoft 365 data backed up separately from Microsoft?
2. What exactly is covered: mail, files, SharePoint, Teams?
3. How long do we keep backups for?
4. When did we last test a restore, and what was the result?
5. Who is alerted if a backup fails?

If you don’t get clear answers, that’s worth following up. It’s far better to find out now than on the day you need the data.

We set up and manage Microsoft 365 for businesses of different sizes, including backup, security and administration. If you’d like a straight answer on where you stand, we’re happy to take a look.