Many businesses assume that because their email and files live “in the cloud,” Microsoft is backing everything up. It’s an understandable assumption, and an expensive one if it turns out to be wrong.

Microsoft does an excellent job keeping Microsoft 365 running. But keeping a service available and protecting your data from loss are two different jobs.

The shared responsibility model

Cloud services work on what’s often called a shared responsibility model. In simple terms:

  • Microsoft is responsible for the service: the data centers, hardware, uptime, and making sure the platform itself doesn’t fail.
  • You are responsible for your data: who can access it, what happens when it’s deleted or changed, and how you recover it.

If a Microsoft server fails, Microsoft has redundancy to keep things running. If an employee deletes an important folder, or ransomware encrypts your files, that’s generally on your side of the line.

Common ways businesses lose Microsoft 365 data

  • Accidental deletion. Someone deletes an email folder, a SharePoint library, or a OneDrive file, and nobody notices until weeks later.
  • Departing employees. When a user’s license is removed, their mailbox and OneDrive are typically kept only for a limited period, often around 30 days by default, before being permanently deleted.
  • Ransomware. If a computer gets infected, encrypted files can sync straight to OneDrive or SharePoint, replacing good copies with unusable ones.
  • Malicious or careless insiders. A disgruntled employee can delete data on the way out.
  • Sync and migration problems. Errors during migrations or file syncs can overwrite or remove data.

“But Microsoft has a recycle bin”

It does, and it helps with small, quick mistakes. But the built-in recovery options have limits:

  • Deleted items are only kept for a limited time. For example, SharePoint and OneDrive recycle bins generally hold items for up to 93 days, and deleted email is recoverable for a shorter window by default.
  • Restoring large amounts of data, or restoring to a specific point in time, can be difficult or impossible with built-in tools.
  • If an account is compromised, an attacker may be able to empty recycle bins too.

Retention policies aren’t the same as backup either. They’re designed mainly to keep records for compliance, not to quickly restore everything after an incident.

What a good Microsoft 365 backup looks like

  • An independent copy stored separately from your Microsoft 365 environment, so a problem in one doesn’t affect the other
  • Automatic, frequent backups without anyone needing to remember to run them
  • Coverage for the whole suite: Exchange Online email, OneDrive, SharePoint, and Teams
  • Granular restores, so you can recover one email, one file, or an entire mailbox
  • Longer retention than built-in tools, so you can go back further in time
  • Monitoring, so someone knows if a backup stops working

Questions to ask yourself

  • If an employee deleted a critical folder three months ago, could we get it back?
  • What happens to a former employee’s email and files after they leave?
  • If ransomware hit one of our computers today, how would we restore our cloud files?
  • Who is responsible for checking that our backups are working?

If any of those answers are “I’m not sure,” it’s worth a closer look.

How CTS protects Microsoft 365

Creative Tech Solutions provides Microsoft 365 backup using Keepit, covering supported workloads such as Exchange Online, OneDrive, SharePoint, and Teams, depending on licensing and configuration. We monitor backup health and help restore data when you need it, whether that’s a single file or an entire mailbox.

Want to know how well your Microsoft 365 data is protected? Schedule a free consultation, or learn more about our backup and disaster recovery services.