The Microsoft 365 assumption worth checking before you need to
30 Aug 2026
Published in: Member News
Most businesses believe Microsoft backs up their data. Microsoft's own agreement says otherwise, and the safety nets people rely on run out faster than anyone expects. Here is what to check, and it takes an afternoon.
Ask whoever looks after your IT what would happen if a member of staff deleted a folder of client files and nobody noticed for four months. In a lot of Black Country businesses the honest answer is a pause, followed by "it will be in the cloud somewhere."
It usually is not. And the gap between what people assume and what is actually true is one of the more expensive misunderstandings in business technology, precisely because nothing goes wrong until the day it really does.
What the agreement actually says
Microsoft's Services Agreement recommends that customers regularly back up their own content. That one line sets out a division of responsibility most organisations have never consciously agreed to.
Microsoft looks after the platform. The datacentres, the uptime, the fact that Outlook opens on Monday morning. That side of it is genuinely excellent, which is exactly why so few businesses ever question the rest.
Getting your own data back is your responsibility. Not because Microsoft is being awkward, but because that is how every major cloud platform works. The difficulty is that nobody sends a letter explaining it.
The features people mistake for a backup
The usual response is that everything is recoverable anyway. There is a recycle bin, there are previous versions, and somebody once got a deleted file back without much fuss.
All true, and all more limited than people expect:
- Deleted files in SharePoint and OneDrive sit in the recycle bin for 93 days, then they are gone permanently.
- Deleted emails in Exchange are held for 14 days by default, extendable to 30.
- Version history rescues a document that was overwritten, and does nothing at all if the file, the folder or the whole account has been deleted.
The common thread is that every one of these lives inside the same system it is meant to protect. They are short-term safety nets for everyday accidents, which is precisely what Microsoft designed them to be. They were never intended as a backup, and were never described as one.
Three moments when it bites
Data rarely disappears dramatically. It goes quietly, and almost always in one of three situations.
When someone leaves.
This is the most common by a distance. A member of staff moves on, the licence is removed to stop paying for it, and their OneDrive enters a deletion countdown. Months later somebody goes looking for a document that person owned. Nobody did anything wrong; the offboarding process simply had no step for keeping the data.
When something malicious happens.
An attacker inside an account can delete at scale and empty the recycle bins on the way out. Without a separate copy, there is nothing left to restore from.
When the conversation happened in Teams.
Plenty of businesses now hold their most useful discussions in Teams chats and channels rather than email. Those messages are among the least protected things in the entire platform, and are routinely overlooked.
Three questions worth asking this week
None of this needs a project. Three questions will tell you where you stand.
- What happens to a leaver's files? If the answer is that the licence gets removed and nobody is quite sure after that, you have found a gap worth closing.
- Has anyone ever tested a restore? A backup nobody has restored from is a theory rather than a plan. Testing one is usually a short job, and it is the only thing that proves the arrangement works.
- What is actually covered? Many businesses protect email and files while leaving Teams conversations and user accounts entirely unprotected, without ever having made that decision deliberately.
If you want the detail, including the exact retention windows for each part of Microsoft 365 and how Microsoft's own backup product compares with the third-party options, our full guide to Microsoft 365 backup sets it out in plain English.
The wider point
Backup is worth an afternoon of anyone's time, but the issue it exposes is bigger than backup.
Most Microsoft 365 environments were set up quickly, by whoever was available, to solve the problem in front of them at the time. They then grow for years without anyone stepping back to ask what is protected, who has access to what, or which assumptions were never actually checked. Nothing looks wrong, because nothing has gone wrong yet.
That is usually where the risk sits. Not in one dramatic failure, but in a series of perfectly reasonable decisions that nobody has revisited. A short review of how your tenant is set up tends to surface several of them at once, and most are quick to put right once somebody has looked.
This article was contributed by Vantage 365, a Microsoft Solutions Partner based in Brierley Hill working with businesses across the Black Country.
If you are not certain what is protected in your Microsoft 365 environment, our free Microsoft 365 Risk and Cost Health Check reviews where your data stands, and our full guide to Microsoft 365 backup is free to read. You can find out more at vantage365.com.
Comments
Post A Comment
You must be logged in to post a comment. Please click here to login.
Our Patrons
