"It's in the cloud, right? Then it's safe." That's what many organizations think. And it's only half true.

Microsoft ensures that Microsoft 365 is available. That servers don't crash and your data isn't lost due to a broken drive. But if you or an attacker deletes data? It's much more complicated.

Shared Responsibility

In the cloud, you share responsibility with Microsoft:

  • Microsoft handles: the infrastructure, availability, and physical security.
  • You handle: who has access, what happens to the data, and whether you can recover that data.

What's included by default?

Microsoft 365 has built-in safety nets:

  • Recycle Bins: deleted files and emails remain recoverable for a limited time.
  • Version History: previous versions of documents are preserved.
  • OneDrive Restore: you can revert a OneDrive to an earlier state.
  • Retention Policies: with Microsoft Purview, you determine how long information is retained.

That is valuable. But it's not a backup in the traditional sense.

Why it's not enough

  • Time Limits: after the recycle bin retention period, data is truly gone.
  • Ransomware: restoring large quantities of encrypted files is challenging.
  • Administrator Errors: an incorrectly deleted site or mailbox may fall outside the safety nets.
  • Departing Employees: if an account is deleted, the data disappears after a period as well.
  • Retention Policy is not a Recovery Plan: it helps you retain information, but not to quickly restore an entire environment.

The Options

Microsoft 365 Backup

Microsoft offers its own backup service for SharePoint, OneDrive, and Exchange. You pay based on usage. The backup is within Microsoft and restores quickly.

An External Backup Solution

Specialized providers create a copy outside of Microsoft. This offers extra assurance if you want to store data elsewhere, for example, due to policy or NIS2.

Don't Forget Teams

Teams conversations and files are scattered across Exchange and SharePoint. Check if your backup solution covers this adequately.

Test Your Recovery

A backup is only valuable if you can restore it. Therefore, test periodically whether the recovery works. How quickly can you restore a deleted site? And a complete mailbox?

Peace of Mind

At 365 Angels, we work with you to see what your organization really needs. Not a standard package, but a recovery plan that fits your risks.

Are you sure you can recover your Microsoft 365 data? Schedule a meeting and we'll review it together.

Frequently Asked Questions

Does Microsoft back up my data?

Microsoft ensures the availability of the service. For a full backup that you can recover from, you need a separate solution.

How long are deleted files retained?

It varies by service and setting. In SharePoint and OneDrive, it is typically 93 days. For mail, it is shorter.

Is a backup required for NIS2?

NIS2 requires business continuity, including backups. A good backup of Microsoft 365 logically belongs to that.