"It's in the cloud, so it's backed up" is one of the most common things we hear from offices around the Coachella Valley. It is an easy assumption to make. Microsoft 365 is very reliable, but reliable and backed up are not the same thing. Here is what Microsoft does and doesn't do for you, and where small businesses get caught out.
What Microsoft is responsible for
Microsoft keeps the service running: its data centers, hardware, and protection against its own outages. If one of its servers fails, your mailbox doesn't disappear. Microsoft calls this a shared responsibility model. It looks after the platform. You are responsible for your data: who can access it, what gets deleted, and getting it back.
What the built-in "safety nets" cover
- Deleted email: after it leaves Deleted Items, it can usually be recovered for about 14 days by default (an administrator can raise that to 30). Then it is permanently removed.
- OneDrive and SharePoint files: deleted files go to a recycle bin for a limited time, and OneDrive can roll files back to an earlier point within roughly the last 30 days.
- Departed employees: when a user account is deleted, the mailbox and OneDrive are kept only for a short period before they are permanently removed, unless someone keeps them on purpose.
These tools are useful for "I deleted something yesterday." They are not designed to bring back something you discover missing months later.
Where small offices get caught out
- Mistakes found too late. A folder deleted in spring and needed in the fall is usually long gone.
- Ransomware. If a computer is infected, encrypted files can sync straight into OneDrive and SharePoint, replacing the good copies.
- Departing staff. An account is removed during offboarding, and weeks later someone needs an email or file that only that person had.
- A compromised account. Someone who gets into a mailbox can delete messages or set up rules that hide what they did.
- Records you have to keep. Medical, legal and financial offices often need to keep records for years. Recycle bins do not meet that kind of requirement.
How to close the gap
- Add a separate backup. A dedicated Microsoft 365 backup keeps copies of email, OneDrive, SharePoint and Teams outside your main account, with history going back as far as you need.
- Test restores. A backup only counts if you can get data back. Try restoring a mailbox or a folder now and then.
- Plan for offboarding. Decide what happens to a departing employee's mailbox and files before the account is removed.
- Protect sign-ins. Multi-factor sign-in on every account stops most of the account takeovers that lead to deleted or stolen data.
Common questions
Does Microsoft back up my Microsoft 365 data?
Microsoft protects its own service against hardware failures and outages, but it does not keep a separate, long-term backup of your email and files that you can restore from at any point. Deleted items are kept for a limited time and then removed for good.
How long can I get deleted email back?
By default, deleted email can usually be recovered for about 14 days after it leaves the Deleted Items folder, and an administrator can extend that to 30 days. After that it is gone unless you have a backup.
Is OneDrive a backup?
Not on its own. OneDrive syncs changes, so a file that is deleted, overwritten or encrypted by ransomware on a computer is changed in OneDrive too. Its recycle bin and restore tools help for a limited time, but they are not a separate copy.
Next step
Not sure what would happen if someone in your office deleted the wrong folder, or a laptop got ransomware? We can check your Microsoft 365 setup during a free IT assessment and tell you in plain English what is protected and what is not.