Ask most business owners whether their email and files are backed up, and the answer is some version of “it’s in Microsoft 365, so yes.” It’s one of the most consequential false assumptions in SME IT – and when Indigo IT audits the environment of a business we’re taking on, it’s among the most common gaps we find. The uncomfortable part is that the assumption sounds so reasonable. Microsoft is a trillion-dollar company; surely they’re not losing your data?
They’re not. But there’s a crucial difference between Microsoft not losing your data and Microsoft being able to give it back when you lose it. The first is their job. The second, in their own documentation, is explicitly yours.
The shared responsibility model, in one paragraph
Microsoft’s responsibility is the service: keeping Exchange, SharePoint, OneDrive and Teams available, replicated across data centres, and resilient against their infrastructure failing. Your responsibility is the data inside it: what your users create, delete, corrupt or lose control of. Microsoft’s own services agreement recommends regular third-party backup of content stored in its services. Data centre redundancy protects against Microsoft’s disasters; it does nothing about yours – because a deletion, a ransomware encryption or a malicious edit replicates across those redundant data centres just as faithfully as a legitimate change.
What the built-in retention actually gives you
Microsoft 365 does retain deleted content – briefly, and in ways designed for oops-moments rather than disasters:
- Exchange — Deleted emails sit in recoverable folders for a limited window (30 days by default once purged from Deleted Items); deleted mailboxes are recoverable for 30 days after a user account is removed. After that, gone.
- SharePoint and OneDrive — Deleted files pass through a two-stage recycle bin totalling 93 days. Version history helps with individual corrupted files — but restoring thousands of files to a precise point in time across a whole site is not what it’s built for.
- Teams — Chats and files inherit the above; channel conversations have their own quirks. Almost nobody knows what their Teams retention actually is until they need it it’s a standard question in Indigo IT’s onboarding audit for exactly that reason.
Notice what all of these have in common: they’re time-limited safety nets against accidental deletion. None of them is a backup — an independent, point-in-time copy, held separately from the live system, restorable at scale.
Four scenarios where the safety nets fail
- The late discovery — An employee deletes a project folder in March; the client asks for it in July. 93 days elapsed in June. This is the most common version of this disaster, and the most mundane.
- Ransomware via sync — Ransomware doesn’t only hit servers – it encrypts synced OneDrive and SharePoint files, and the encrypted versions sync everywhere. Version history can help file-by-file; recovering an entire organisation’s files to ‘the moment before’ needs a real backup.
- The malicious leaver — A departing employee quietly clears out mailboxes or document libraries on the way to a competitor. By discovery, retention windows may have closed – taking your legal evidence with them.
- The deleted leaver — An account is deleted during offboarding; six months later a dispute requires that person’s correspondence. The 30-day mailbox window closed long ago. (Retention policies and litigation hold can prevent this – if configured before the event, which is rather the point.)
What proper Microsoft 365 backup looks like
A third-party backup service that takes automated copies of Exchange, SharePoint, OneDrive and Teams several times daily, stores them independently of Microsoft’s infrastructure, retains them for years rather than weeks, and restores anything from one email to an entire site to a chosen point in time. For SME tenancies this typically costs a few pounds per user per month – comfortably the cheapest insurance in your IT budget — and it’s increasingly a question insurers ask directly.
Retention policies, litigation hold and the compliance features in higher 365 licences solve related-but-different problems: they preserve data for legal reasons inside the same system. Valuable, and not a substitute – if the tenancy itself is compromised, everything inside it is compromised together.
Where Indigo IT comes in
Independent Microsoft 365 backup is part of how Indigo IT builds managed environments for SMEs across Surrey, Hampshire and Berkshire — alongside checking the settings most businesses have never looked at: retention policies, litigation hold, and what actually happens to a leaver’s mailbox and OneDrive when HR closes the account. If you’re not certain what your own tenancy would give back after a bad day, that’s worth knowing before the bad day: Indigo IT can review your current retention position and show you precisely where the gaps are, usually in a single short session. It’s also covered in every new-client audit we run, because the businesses that need this article most are the ones who were never told.
Frequently asked questions
Has Microsoft ever said we should back up 365 ourselves?
Yes — its services agreement explicitly recommends regular backup of your content using third-party services, and its documentation of the shared responsibility model places data protection with the customer. This isn’t a vendor conspiracy theory; it’s Microsoft’s stated position.
We’ve never lost anything in years of using 365. Isn’t this overblown?
You’ve also probably never claimed on your buildings insurance. The maths of backup is the maths of insurance: a small certain cost against a rare, potentially existential one. The 93-day discovery scenario alone – mundane, common, uninsurable after the fact – justifies it.
Does this apply to Google Workspace too?
Entirely. The shared responsibility model is universal across SaaS platforms; only the retention windows differ. If your business runs on Google, the same conclusion applies with different numbers.
