“It’s in the cloud, so it’s backed up.” We hear this a lot, and it’s one of the most expensive misunderstandings in small business IT.
What Microsoft does – and doesn’t – do
Microsoft works on a shared responsibility model. Microsoft makes sure the service stays up: its data centres, hardware and the availability of Exchange, SharePoint, OneDrive and Teams. Protecting the data inside your account is your responsibility.
Microsoft 365 does have recycle bins and retention features, but they’re limited:
- Deleted emails are only recoverable for a limited time (14 days by default, and up to 30 days if configured).
- Files deleted from SharePoint and OneDrive sit in the recycle bin for up to 93 days, then they’re gone.
- When a staff member leaves and their licence is removed, their mailbox and OneDrive are deleted after a short grace period.
None of these is a true backup: a separate copy of your data, stored somewhere else, that you can restore from at any point.
How businesses actually lose data
- Accidental deletion. Someone tidies up a shared folder and nobody notices for three months.
- Ransomware. Encrypted files on a laptop sync straight up to OneDrive and SharePoint, overwriting the good copies.
- Malicious or careless leavers. Data removed on the way out the door.
- Sync and migration errors. A misconfigured sync can wipe or duplicate thousands of files in minutes.
In every one of these cases, Microsoft’s own tools may not get you back to where you were.
What a proper backup looks like
We use Datto SaaS Protection to back up Microsoft 365 for our clients. It gives you:
- Automatic backups of Exchange email, contacts and calendars, OneDrive, SharePoint and Teams, three times a day.
- Copies stored independently of Microsoft.
- Point-in-time restores, so you can roll a folder back to how it looked last Tuesday before the ransomware hit.
- Restores of individual emails or files without overwriting everything else.
- Retained data for leavers, without paying for their licence.
The question to ask
If your most important SharePoint folder was deleted or encrypted this afternoon, how would you get it back, and how long would it take? If you don’t know the answer, it’s worth a conversation.
