It comes up in nearly every IT review we run. We ask what happens if someone deletes a folder they should not have, and the answer is some version of "it's in the cloud, Microsoft handles that."
Microsoft does not handle that. They are explicit about it, in writing, and almost nobody has read the paragraph.
What Microsoft actually says
From the Microsoft Services Agreement, section 2.a:
"We strongly advise you to make regular back-up copies of Your Content."
And again at section 6.b: "We recommend that you regularly backup Your Content and Data that you store on the Services."
This is not buried legalese designed to catch you out. It is a plain statement of how the arrangement works, repeated in three separate places.
The shared responsibility model
The confusion comes from conflating two different things.
Microsoft is responsible for the service. Keeping it running, replicating your data across their datacentres so a failed disk or a flooded building does not lose it, patching the platform, defending the infrastructure. They are extremely good at this.
You are responsible for the data. What goes in it, who can reach it, and whether you can get it back after something you did — or something done in your name.
Replication is not backup. Replication faithfully copies every change to three places, including the change where someone deleted six months of correspondence. That is the whole problem: it works exactly as designed.
What the built-in retention does cover
It is not nothing, and it is worth knowing where the edges are. On default settings:
| Where | Roughly what you get |
|---|---|
| Deleted email | Recoverable from Deleted Items, then a further recoverable window after that — a matter of weeks, not months |
| SharePoint and OneDrive files | A two-stage recycle bin totalling around 93 days, plus version history on individual files |
| A deleted user's mailbox | A short grace period, then it goes — along with the licence |
| Teams chat | Governed by your retention policy, and files live in SharePoint anyway |
Those windows can be extended with retention policies and legal holds, and if you are in a regulated sector you probably should. But a retention policy is a compliance tool. It is designed to stop things being deleted, which is a different job from getting something back.
The five gaps
Here is where it actually bites. None of these are exotic; we have seen all five.
1. The deletion nobody notices in time
A shared folder is tidied up in March. In August someone needs the 2023 contracts. The recycle bin emptied itself five months ago. Retention windows only help if you notice inside them, and the things you lose quietly are exactly the things nobody looks at weekly.
2. Ransomware that syncs
Files encrypted on a laptop with OneDrive running are dutifully synchronised to the cloud in their encrypted state. The cloud copy is now encrypted too. Version history can sometimes rescue this, file by file, if it is enabled and the versions have not been exhausted — which is a dreadful afternoon for anything more than a handful of documents.
3. The departing employee
Somebody leaves on bad terms and clears out their mailbox and OneDrive on the way. Or leaves on perfectly good terms, and you reclaim the licence a month later — which deletes the mailbox with it. That one is entirely self-inflicted and extremely common.
4. A compromised account
An attacker in a mailbox often deletes as they go, to hide what they read and what they sent in your name. By the time you know, the evidence has been tidied away too.
5. Leaving Microsoft
Once the tenant is gone, it is gone. If you ever migrate elsewhere or consolidate after an acquisition, an independent copy of your data turns a tense project into an ordinary one.
The test worth applying. Ask: if a folder was deleted six months ago and nobody noticed, could we get it back? If the honest answer is no, you do not have backup. You have retention, which is a different thing wearing similar clothes.
What proper backup adds
- Retention you choose — years, not weeks, set by what your business and your regulator need rather than by a platform default.
- Point-in-time restore — put a mailbox or a site back as it was on a given morning, rather than hunting file by file.
- A copy outside the tenant — so a compromised global admin account cannot delete your recovery options along with everything else.
- Restores that get tested — the part everyone skips, and the only part that proves the rest works.
The same argument applies to Google Workspace, incidentally. Google's position is materially the same as Microsoft's, and so are the five gaps.
What to do this week
- Find out whether you have Microsoft 365 backup at all. Plenty of businesses are paying for it and do not know, and plenty assume they have it and do not.
- Ask whoever runs your IT to restore something. Not to confirm backup is running — to actually restore a file from three months ago and show you.
- Decide how far back you need to be able to go, and write the number down. That one decision determines the design and most of the cost.
If you would rather someone just looked at it, that is what the free IT review is for. And there is more detail on how we set this up on our backup and disaster recovery page.