The most common misunderstanding in small-business IT is that data in Microsoft 365 is backed up because it is in the cloud. It is not, and Microsoft has never said it was.

What Microsoft guarantees is that the service will be available and that your data will survive their infrastructure failing. What happens to your data because of something you or your staff or an attacker does is explicitly your responsibility. That is the shared responsibility model, it is published, and it is the entire point of this article.

What you actually get without a backup

The native protections are real, and they are shorter than people assume.

  • Deleted items folder. Until somebody empties it.
  • Recoverable items. 14 days by default, extendable to 30.
  • Deleted mailbox. Recoverable for 30 days after the account is removed.
  • SharePoint and OneDrive recycle bins. 93 days across the two stages.
  • Version history. Useful for a file overwritten badly, useless for a file deleted along with its versions.

Those windows cover the ordinary accident. They do not cover the four scenarios that actually cost businesses money.

The four gaps

1. The mistake nobody noticed

A folder of project correspondence deleted during a tidy-up in January and needed in June when the project becomes a dispute. The retention window closed four months ago.

This is by far the most common real loss, and it is silent by nature. Nobody reports it, because nobody knows.

2. The departing employee

An account is removed to stop paying for the licence. Thirty days later the mailbox is gone permanently. Two months after that somebody needs the thread where the customer agreed to the variation.

3. Ransomware and mass deletion

Modern attacks encrypt or delete files at scale, and OneDrive sync obediently propagates the damage to the cloud. Version history helps, up to a point, and that point arrives quickly when tens of thousands of files are affected across many sites.

4. The compromised administrator

The scenario native tooling cannot help with. An attacker with administrative access can disable retention, purge mailboxes and empty recycle bins. Everything designed to protect data inside the tenancy is under the control of the account that has been compromised.

Retention protects you from your users. Backup protects you from your administrators, and from yourself.

Retention is not backup

Worth stating plainly, because it is the confusion that leaves businesses exposed while believing they are covered.

Retention prevents deletion for a defined period. It exists for compliance and legal hold. It has no concept of a point in time to restore to, and recovering something specific from it is a search-and-export exercise rather than a restore.

Backup gives you an independent copy, outside the tenancy's control, with point-in-time restore, granular recovery of a single item and protection against administrative action.

Most businesses need both. They cost different amounts and answer different questions.

What a proper backup covers

All four workloads. Backups that cover only mailboxes are common and leave the majority of a modern business's working data unprotected.

  • Exchange Online — mailboxes, calendars, contacts and shared mailboxes.
  • OneDrive — every user, including departed ones during their grace period.
  • SharePoint — document libraries, lists and site metadata and permissions.
  • Teams — channel conversations as well as files. Chat history is the piece most often missing.

What to look for in a provider

  • Retention you choose, not a fixed 30 days. Seven years is common for businesses in regulated sectors.
  • Granular restore. One email back into the original folder, not a mailbox export you then have to search.
  • Immutable storage. So a compromised account cannot delete the backups.
  • UK or EU data residency if that matters to your clients or your contracts.
  • A tested restore. Ask the supplier to demonstrate one during evaluation. This filters out more products than any feature list.

Expect £2 to £5 per user per month in the UK. For a ten-person business that is a few hundred pounds a year against a data loss that routinely costs thousands in recovery time alone.

Test it, or it is not a backup

The rule that applies to every backup ever configured. Once a quarter, restore something real — a mailbox item, a document, a whole site — and time it.

You are testing two things: that the data comes back, and that somebody in the business knows how to make it come back. The second is the one that fails during an actual incident. There is more on this in backups that actually restore.

Where to start

If you have nothing, get mailbox and OneDrive backup running this month and add SharePoint and Teams next. If you have mailbox backup only, add the other three, because that is where your project documentation and your Teams conversations live.

Then test a restore, and put a reminder in the calendar to test another one in three months.

Our backup and recovery service covers all four Microsoft 365 workloads with tested restores as part of the service rather than as an extra. Ask us what your current retention window really is — most businesses are surprised.