Most business owners assume that because their email, files and Teams chats live in Microsoft 365, Microsoft is quietly backing all of it up. It is a reasonable assumption. It is also, for the way most people mean the word "backup", not correct.
This gap catches businesses out every week, and it is worth understanding before you find out the hard way.
The shared responsibility model
Microsoft operates on what is called a shared responsibility model, and the split is simple once you see it:
- Microsoft is responsible for the service — keeping Microsoft 365 online, replicated across data centres, and protected against their infrastructure failing.
- You are responsible for your data — the emails, files and records inside the service.
In other words, Microsoft guarantees the platform will be there. It does not guarantee that the specific file a staff member deleted three months ago will still be recoverable when you need it.
What Microsoft 365 does and does not protect against
Microsoft's built-in features — like the recycle bin and retention policies — offer some short-term protection. But they are limited, and they are not a true backup. They generally will not save you from:
- Accidental or malicious deletion discovered after the retention window has passed.
- A departing employee taking or wiping data, or a mailbox being removed to save on licensing.
- Ransomware or account compromise that encrypts or destroys content across the tenant.
- Long-term retention needs for compliance, where you must produce records from years ago.
Retention is about keeping data for a set period. Backup is about being able to restore a clean copy of your data to a point in time, on demand. They are not the same thing.
Why this matters more than it used to
Two things have raised the stakes. First, businesses now run almost entirely inside Microsoft 365 — email, documents, SharePoint, Teams. If that data is lost or held to ransom, the business effectively stops.
Second, if you handle personal or sensitive information — as NDIS providers, healthcare and professional services do — losing it is not just operationally painful. It can trigger obligations under the Privacy Act and the Notifiable Data Breaches scheme.
What good M365 protection looks like
A proper Microsoft 365 backup solution should:
- Back up automatically, every day, across Exchange, OneDrive, SharePoint and Teams.
- Retain data for as long as you need — not just a default number of days.
- Allow granular restore — recover a single email or file, not just an entire mailbox.
- Store copies independently of your Microsoft tenant, so a compromised account cannot reach the backups.
- Be tested, so you know a restore will actually work when it counts.
The takeaway
Microsoft 365 is an excellent, resilient platform — but resilience of the service is not the same as protection of your data. If your only "backup" is the recycle bin and a retention policy, you are one deletion, departure or attack away from a very bad day.
The fix is straightforward: a dedicated, independent backup for your Microsoft 365 environment, set up once and monitored ongoing. It is one of the first things we check on any new client's environment, precisely because so many are surprised by what is not covered.