“It’s in the cloud” is probably the most expensive assumption in small business IT. Microsoft 365 is extremely reliable as a service. It is very rarely down, and Microsoft replicate your data across their data centres so a hardware failure on their side won’t lose it. But that protects Microsoft’s platform, not your ability to get back something your own people deleted, overwrote or lost to an attacker.
The shared responsibility model
Microsoft are clear that responsibility is shared. They are responsible for the infrastructure: keeping the service available and the data centres secure. You are responsible for your data, your accounts and who can access them. If someone in your business deletes a folder, or an attacker encrypts a SharePoint library, Microsoft will not restore it for you beyond the limits of the built-in retention.
What the built-in safety nets actually cover
Microsoft 365 does have recovery features. They are useful for accidents spotted quickly. They are not designed as a backup.
| What was lost | Built-in recovery | The catch |
|---|---|---|
| Deleted email | Deleted Items, then a recoverable items area, by default for 14 days (configurable up to 30) | After that, it is gone unless a retention policy or hold was set up in advance |
| Deleted files in SharePoint or OneDrive | Two-stage recycle bin, 93 days in total | Day 94 is too late, and many deletions aren’t noticed for months |
| Files encrypted by ransomware | OneDrive and SharePoint version history, or OneDrive’s Restore feature | Works for some scenarios, but is limited and awkward at scale |
| A leaver’s mailbox and OneDrive | A short grace period after the licence is removed | Once that passes, the data is permanently deleted |
Retention policies and litigation holds can extend some of these, but they are compliance features. They keep data, they don’t make it easy to restore a folder to how it looked last Tuesday.
The scenarios that catch businesses out
- The slow-burn deletion. Someone tidies up a shared folder. Four months later, an accountant asks for a document that was in it.
- The departed employee. A leaver’s licence is removed to save money, and their mailbox and OneDrive quietly disappear after the grace period, along with client correspondence nobody else had.
- Ransomware through sync. An infected laptop encrypts files that OneDrive dutifully syncs back to the cloud.
- A compromised account. An attacker with a stolen password deletes mail to cover their tracks, or wipes data on the way out.
- Mistakes during a migration or restructure. A site is removed or permissions are changed, and content goes with it.
What good Microsoft 365 backup looks like
- Independent of Microsoft. Stored outside your tenant, so a compromised admin account can’t delete both the data and the backup.
- Covers everything. Exchange mailboxes, OneDrive, SharePoint and Teams.
- Frequent. At least daily, ideally several times a day.
- Kept long enough. Retention set by your business and legal needs, not a 30-day default.
- Granular restores. One email, one file, a folder as it was on a date, or a whole mailbox to a different person.
- Tested. Someone actually restores from it on a schedule.
How we handle it
Both of our Microsoft 365 bundles include independent cloud-to-cloud backup of Exchange, SharePoint and OneDrive in UK data centres, with unlimited storage, alongside your licence and advanced email security. Microsoft 365 Ultimate adds 24/7 detection and response, staff training and managed signatures. For servers and laptops, see backup and recovery.
Quick answers
Is OneDrive a backup?
No. OneDrive syncs files, which means deletions and encryption sync too. Version history helps in some cases but isn’t a substitute for an independent backup.
Does Microsoft back up my data?
Microsoft replicate data to protect their service against failures on their side. They don’t provide a backup you can restore from after your own users or an attacker delete or change it, beyond the limited retention periods.