Retention is not backup — what Microsoft 365 does not protect
Microsoft protects the platform. Protecting your data in it is your responsibility, and the gap only becomes obvious at the worst possible moment.
Ask an IT team whether their Microsoft 365 data is backed up and you will usually get one of three answers:
- “Yes, Microsoft handles it.”
- “Yes, we have retention policies.”
- ”…I should check.”
Only the third is a good answer.
What Microsoft actually commits to
Microsoft’s own shared responsibility model is clear, and it is worth reading rather than assuming. Microsoft is responsible for the platform: the infrastructure, its availability, its resilience, and protecting it from their side of the line.
You are responsible for your data: the accounts, the configuration, the permissions, and what happens to the content inside them.
That is not a gotcha. It is the same division every major SaaS platform uses. The problem is that “the platform is highly available” gets heard as “our data is safe”.
What the built-in features actually do
Recycle bins. Deleted items sit in a first-stage and second-stage recycle bin for a defined window — commonly 93 days in SharePoint and OneDrive. After that they are gone.
Retention policies. These are a compliance control. They stop data being deleted before a defined period, which is genuinely useful, but retention is designed to satisfy a records obligation, not to restore a mailbox to how it looked last Tuesday.
Litigation hold. Preserves content for legal discovery. Again: a compliance mechanism, not a restore mechanism. The recovery experience is nothing like a backup.
Versioning. Helpful against a bad edit. Unhelpful against ransomware that encrypts every version, or a mass deletion that removes the file and its history together.
Each of these solves a real problem. None of them is the thing people mean when they say “backed up”.
The scenarios that actually catch organisations
The departed employee. An account is deleted as part of offboarding. Ninety-four days later somebody needs a document only that person held. The mailbox and OneDrive are gone.
The quiet deletion. A user clears out a SharePoint library they think is obsolete. Nobody notices for four months. Both recycle bins have long since emptied.
The compromised administrator. An attacker with global admin rights can disable retention, empty recycle bins and delete accounts. Every control that lives inside the tenancy is reachable by an account that controls the tenancy — which is precisely why an independent copy matters.
Ransomware via sync. OneDrive and Teams sync clients faithfully replicate encrypted files up to the cloud. Versioning helps if the attacker was sloppy. It frequently is not.
The migration that went wrong. Tenant-to-tenant migrations, mailbox moves and licence changes all have failure modes that lose data, and none of them are Microsoft’s fault or Microsoft’s problem.
What proper protection looks like
Held outside the tenancy it protects. This is the whole point. A copy that a compromised administrator of your tenancy can reach is not an independent copy.
Immutable for a defined period. Retention that cannot be shortened or deleted, by anyone, until it expires.
Covering all four workloads. Exchange Online, SharePoint, OneDrive and Teams. Teams is the one most often missed, and its data is scattered across SharePoint, Exchange and the chat service in ways that surprise people.
Onshore, if that matters to you. For Australian government and regulated customers, where the backup copy physically sits is part of the requirement, not an afterthought.
Restore-tested on a schedule. With the result written down. An untested backup is a hypothesis.
The one question worth asking your provider
Not “do we have backups”. Ask:
“When did you last restore something from Microsoft 365, what was it, how long did it take, and can I see the report?”
The answer separates the organisations that have a backup regime from the organisations that have a backup product. Those are not the same thing, and the difference only becomes visible on the day it matters.
If nobody can answer that question in your environment, that is a reasonable place to start.