Microsoft 365 Backup: Why Microsoft Won't Save Your Data

The assumption that catches businesses out

Most small-business owners believe that once their email and files live in Microsoft 365, they’re automatically backed up. It feels reasonable. It’s Microsoft, it’s the cloud, and everything just seems to be there whenever you log in.

But Microsoft does not back up your data the way you probably think. If an employee deletes a folder of important emails, if a leaver’s mailbox gets wiped, or if ransomware tears through your files, the copies you assumed were safe may simply not exist.

This isn’t a scandal or a hidden trap. It’s written plainly in how the service works. The problem is that hardly anyone reads it until the day they desperately need a file back.

Shared responsibility: whose job is your data?

Microsoft runs what’s called a shared responsibility model. In plain English, the jobs are split:

• Microsoft’s job: keep the service running, keep the data centres secure, protect against hardware failure, and make sure the platform is available.
• Your job: protect your actual content, your emails, documents, contacts and settings, against deletion, corruption, ransomware and account mishaps.

Microsoft even says this in its own Services Agreement, recommending you regularly back up your content using third-party tools. In other words, keeping Microsoft 365 online is their concern. Keeping your data recoverable is yours.

Keeping Microsoft 365 online is Microsoft’s concern. Keeping your data recoverable is yours.

“But I can see the recycle bin” — the retention gap

Microsoft 365 does have some safety nets. The recycle bin, version history and retention policies can rescue you from small, recent mistakes. They are genuinely useful, and you should use them.

The catch is that they are short-term by design. Depending on the item and your settings, deleted emails and files are usually only recoverable for a limited window, often somewhere between 30 and 93 days. After that, they’re purged for good.

That causes real problems:

• A member of staff deletes an important email in January. Nobody notices until an audit in June. It’s long gone.
• An employee leaves, you remove their licence to save money, and their mailbox is deleted, along with years of client history.
• A file gets corrupted or maliciously changed, and the clean version has already aged out of version history.

Retention settings are a safety net for last week’s mistakes. A backup is insurance for the ones you don’t spot for months.

Ransomware and the sync trap

Many owners assume cloud storage is immune to ransomware. Unfortunately, it isn’t.

Here’s how it goes wrong. A laptop gets infected. That laptop syncs files to OneDrive or SharePoint. The ransomware encrypts the local files, and because syncing is doing its job, the encrypted versions get pushed straight up to the cloud, quietly overwriting the good copies.

To Microsoft 365, this just looks like normal file activity. There’s no alarm. If your only copies live inside Microsoft 365, you can lose them there too. Ransomware is one of the most common serious threats facing UK small businesses — you can read more in our guide to ransomware protection.

A proper backup, stored separately and out of reach of your live environment, gives you a clean copy to roll back to. That is often the difference between a bad morning and a business-ending week.

The other everyday risks

Ransomware grabs the headlines, but most data loss is far more ordinary:

• Human error — the single biggest cause. Someone deletes the wrong thing, empties a folder, or overwrites a document.
• Departing staff — accounts removed too quickly, taking their data with them.
• Malicious insiders — a disgruntled employee wiping records on the way out.
• Account takeover — an attacker who gets into an account can delete emails to cover their tracks.
• Configuration mistakes — a retention policy set up wrong that silently removes data.

None of these are exotic. They happen to normal businesses every week.

What a third-party backup gives you

A dedicated Microsoft 365 backup takes independent copies of your data and stores them somewhere separate from Microsoft 365 itself. A sensible one covers:

• Exchange — emails, calendars and contacts
• OneDrive — individual users’ files
• SharePoint — shared team sites and document libraries
• Teams — chats and channel content

The features that matter most:

• Long retention — keep copies for months or years, not weeks.
• Separation — stored where ransomware and account problems can’t touch them.
• Fast, precise restore — recover a single email, one file, or a whole mailbox without drama.
• Automated — running quietly in the background with nothing for you to remember.

Backup for Microsoft 365 is best treated as one part of a wider recovery plan. The tried-and-tested approach is the 3-2-1 rule, which we explain in our guide to business backups and the 3-2-1 rule.

What to do next

You don’t need to be technical to get this right. You just need the right setup running in the background:

1. Check what you actually have. Most businesses have far less protection than they assume.
2. Add a dedicated Microsoft 365 backup with long retention and quick restore.
3. Test a restore. A backup you’ve never tested is only a hopeful guess.
4. Write down who’s responsible so it doesn’t quietly fall through the cracks.

At DACROS, we set up and manage Microsoft 365 backup as part of our managed IT services for businesses across Leeds and Yorkshire, so your data is genuinely recoverable, not just assumed to be safe.

Not sure whether your data is actually backed up? Get in touch and we’ll take a look, in plain English, with no jargon and no pressure.