The most expensive misunderstanding in small business IT is assuming Microsoft keeps a copy. It keeps the service running. What happens to your files is your responsibility, and the deletion clock is shorter than almost anyone expects.
Ask most business owners whether their Microsoft 365 data is backed up and the answer is some version of yes, it is in the cloud. It is a reasonable thing to assume and it is not what Microsoft says.
Microsoft operates on a shared responsibility model, and it is published rather than hidden. Microsoft is responsible for the infrastructure — keeping the service available, replicating across datacentres, surviving hardware failure. You are responsible for your data: what is in it, who can reach it, and what happens when somebody deletes it.
What the built-in retention actually gives you
There is real protection built in. It is just shorter and narrower than people think, and it is designed for accidents rather than for recovery from an incident.
| Situation | Default protection |
|---|---|
| Deleted email | 30 days in Deleted Items, then 14 days in recoverable items |
| Deleted OneDrive or SharePoint file | 93 days in recycle bins, then gone |
| Deleted user account | 30 days, after which the mailbox and OneDrive go with it |
| Ransomware encrypting synced files | Version history, if versioning is on and the versions were not also encrypted |
| A departed employee's mailbox | Nothing, once the licence is removed, unless it was put on hold first |
Where the gap actually bites
The failure is rarely a dramatic one. In practice it is one of these:
- Somebody leaves, the licence is reclaimed to save money, and six weeks later a contract dispute needs their email. It is gone, and it went because a bill was being reduced.
- A user tidies a SharePoint library and deletes a folder nobody notices for four months.
- A compromised account deletes mail as it goes — attackers do this deliberately, to hide what they sent.
- Ransomware encrypts a synced OneDrive folder and the encrypted versions replicate to the cloud copy.
- A retention policy was configured years ago by somebody who has left, and it is quietly deleting things.
What a real backup adds
- Retention measured in years rather than days, under your control rather than the platform default.
- Point-in-time restore — the ability to say 'as it was on the 3rd', not just 'the most recent version'.
- Coverage of Exchange Online, OneDrive, SharePoint and Teams together, because a Teams conversation lives across several of those.
- A copy that a compromised administrator account cannot delete. This is the one that matters in a ransomware incident, and it is the one cheapest solutions skip.
- Restore that has actually been tested, which is a different thing from backup that has been configured.
An untested backup is a belief, not a control. The only number that means anything is how long a restore took the last time somebody performed one — and if the answer is that nobody has, that is the finding.
The honest counter-argument
Not every business needs third-party backup on day one. If you are five people, everything of consequence lives in email, and you have retention holds configured properly, you may be adequately covered for a while.
What you should not do is assume you are covered without checking which of these applies to you. The businesses that get hurt are not the ones that decided against backup — they are the ones that never made the decision at all.
Frequently asked
Does Microsoft not keep a copy of everything anyway?
Microsoft keeps the service running and replicates data across its own infrastructure. That protects against their hardware failing. It does not protect against your data being deleted, encrypted or retained past its policy — and their shared responsibility documentation says so plainly.
Is the recycle bin not enough?
For an accidental deletion noticed the same week, usually yes. For a deletion noticed after 93 days, an ex-employee's mailbox after the licence was removed, or an attacker deleting as they go, no.
What does it cost?
Per user per month, and it is one of the cheaper line items in a small business IT budget — typically less than the licence it protects. The real cost of skipping it is only ever paid once.
How do we know our backup works?
Restore something. Not a test file — an actual mailbox or document library, timed, on a normal working day. Any provider unwilling to demonstrate that is telling you something.