A comfortable misconception
The question comes up in every audit, and the spontaneous answer is almost always the same: our data is in the cloud, so it is backed up. The intuition is understandable. Microsoft runs redundant data centres, replicates content, guarantees contractual availability and communicates extensively about the resilience of its infrastructure. Under those conditions, it is hard to imagine anything could disappear.
Yet Microsoft's documentation says exactly the opposite of what most companies think they have understood. The shared responsibility model, published and regularly updated by the vendor, is explicit: whatever the type of deployment, the customer remains the owner of, and responsible for, its data and identities. In the official matrix, the customer data line is assigned to the customer in SaaS just as in traditional infrastructure. Microsoft takes care of the data centre, the physical network, the servers, the operating system and service availability. The content you put there, it does not.
What Microsoft really guarantees
The confusion comes from a slide between two different notions: redundancy and backup. Microsoft provides the first. If a disk fails or a data centre suffers an incident, your data stays accessible because it exists in several synchronised copies. That is protection against hardware failure, and it works well.
Backup addresses a different problem: going back to an earlier state. Replication propagates changes, including bad ones. An overwritten file is overwritten everywhere. A deleted folder disappears from every copy. Ransomware encryption syncs faithfully to the cloud. Redundancy protects against losing a medium, not against error, malice or deletion.
Microsoft does provide a few native safety nets, but they are limited in time and designed to fix an isolated, recent incident, not to bring back an old state. Items deleted from a mailbox remain recoverable for a few days to a few weeks depending on configuration. The SharePoint and OneDrive recycle bin keeps deleted content for a few months. A deleted user account can be restored for about thirty days. Beyond these periods, the data is permanently lost, with no recourse through support.
Scenarios where the native safety net falls short
Four situations come up regularly in small businesses, and none is satisfactorily covered by the built-in mechanisms.
Deletion noticed too late is the most mundane. A shared folder deleted by mistake in January, noticed in May because someone needed it, falls outside every retention window. This case is common precisely because rarely consulted data is the data whose absence takes longest to notice.
An employee leaving raises a similar problem. When the licence is freed up to save money, the associated mailbox and OneDrive disappear after a short delay. Exchanges with customers, documents in progress and the history of the relationship go with them, often without anyone having thought to recover them.
Ransomware, next, does not stop at the workstation. A synced OneDrive client pushes encrypted files to the cloud within minutes. Earlier versions sometimes offer a way out, but the operation is heavy on large volumes and becomes impossible if the incident is discovered beyond the retention window.
A compromised administrator account, finally, is the most severe scenario. An attacker with elevated rights can change retention policies, purge mailboxes and empty recycle bins. Native protections do not withstand someone who has the authority to switch them off.
What compliance adds to the debate
Beyond operational risk, two less visible obligations weigh on the subject.
Legal retention of documents does not line up with Microsoft's default retention periods. A small business must be able to find certain records several years after they were created, and a service designed to undo last week's mistake does not meet that requirement.
Continuity plans also deserve a mention. A business that has formalised a disaster recovery plan must be able to show that its critical data can be restored within the stated times. If email and shared files rely exclusively on native mechanisms, the plan rests on a fragile assumption that has never been tested.
The available solutions, and their limits
Microsoft now offers its own backup service built into the platform. It is a real step forward, with one point to know before deciding: retention is fixed at one year, with no way of extending it, and the organisation's retention or deletion policies do not apply to the backups. This constraint suits protection against incidents, less so a multi-year retention obligation.
Specialist third-party solutions offer more flexibility over duration, choice of storage location and restore granularity. In return, they add another supplier to assess, a cost per user per month, and a point of attention regarding the access granted to the Microsoft 365 tenant.
The third path is to regularly export critical data to storage controlled by the business. This approach takes more work and lends itself poorly to fine-grained restores, but it has one decisive merit: the copy does not depend on any tenant administrator rights, which makes it resilient to the compromise scenario.
Questions to ask before choosing a tool
Whatever option you choose, a few points determine the real value of the arrangement, and they are rarely highlighted in sales pitches.
Restore granularity matters as much as the backup itself: being able to bring back a single message, file or site without overwriting the rest avoids heavy, risky operations. The scope covered deserves to be checked item by item, because not all solutions handle email, files, collaboration sites and team conversations in the same way.
Isolation of the backups is the most important security criterion: a copy that a tenant administrator can delete with one click offers no protection against a compromised privileged account. Finally, you need to know where the data is stored and under which legal regime, a question directly linked to the obligations covered in our article on the GDPR for small businesses.
How to decide without oversizing
The right approach is not to subscribe to a tool as a precaution, but to start from two questions already raised in our article on disaster recovery and business continuity for small businesses: how long can the business manage without this data, and how far back must it be able to go?
A business whose activity relies on email and shared documents, with retention obligations, has an obvious need. A three-person organisation whose important documents are also stored elsewhere can legitimately rely on the native protections, provided this is a deliberate, documented decision and not a belief.
In every case, one rule applies here just as it does to conventional backups, covered in our article on the 3-2-1-1-0 rule: a backup that has never been restored proves nothing. A real restore test, on a limited but representative scope, remains the only way to know whether the arrangement works.
A decision for management
The subject goes beyond the technical because it involves a trade-off between a recurring cost and an accepted risk. It therefore deserves to be put clearly to management rather than settled implicitly by default.
We systematically raise this point during an IT audit, and Microsoft 365 and Intune setup and follow-up makes it possible to check over time that the configured retention periods really match what the business believes it has put in place.
Sources: Microsoft Learn, Shared responsibility in the cloud · Microsoft Learn, Privacy, security, and compliance in Microsoft 365 Backup