It’s one of the most common — and most consequential — assumptions in small-business IT: “Our files are in Microsoft 365, so they’re backed up.” Mostly, they’re not. Understanding why comes down to one concept Microsoft itself puts in writing: shared responsibility.

Microsoft’s job vs. your job

Microsoft’s responsibility is the service: keeping Exchange Online, SharePoint, OneDrive, and Teams running, replicating data across data centers so a hardware failure or outage on their end doesn’t lose anything. They do this extremely well.

Your responsibility is the data: protecting it from deletion, corruption, ransomware, misconfiguration, and departing employees. Microsoft’s services agreement says this plainly — they recommend you regularly back up your content using third-party services.

The distinction matters because replication is not backup. Replication means every copy updates instantly — so when a file is deleted or encrypted, every replica deletes or encrypts right along with it, flawlessly and immediately.

“But I can restore deleted files…”

You can — within limits. Microsoft 365 provides retention, and it’s genuinely useful for everyday oops-moments:

  • Deleted emails are recoverable for a limited window (deleted items, then a recoverable-items period — typically topping out around 30 days after a hard delete on standard settings)
  • OneDrive and SharePoint keep deleted files in recycle bins for up to 93 days, and OneDrive offers a rolling 30-day full restore
  • Versioning lets you roll individual files back to earlier versions

Now, the gaps these windows don’t cover:

Discovery that comes late. A folder deleted in January, noticed in May — when a client asks for it, an auditor requests records, or a legal matter surfaces. The recycle bin emptied months ago. This is the single most common real-world failure mode, because deletions are rarely noticed quickly.

Departing employees. When a user’s license is removed, their OneDrive and mailbox enter a countdown (typically 30 days) and then are gone. Businesses routinely discover this after reassigning the license of someone who left with important files in “their” OneDrive.

Ransomware via sync. Ransomware on one laptop encrypts local files; OneDrive dutifully syncs the encrypted versions to the cloud. Versioning can help — if the attack is caught within the window and you’re prepared to run restores across thousands of files and dozens of users. Point-in-time restore across the whole tenant is exactly what retention wasn’t designed for and backup was.

Malicious insiders and compromised admins. Retention policies can be altered by the same admin credentials an attacker steals. Your safety net and your production system share a single point of failure.

Teams and its plumbing. Teams data sprawls across Exchange, SharePoint, and OneDrive; reconstructing a deleted team or channel from recycle bins is somewhere between painful and impossible.

Retention answers “I deleted something this month.” It does not answer “restore everything to how it was before the incident.”

What proper Microsoft 365 backup looks like

A third-party backup tool (well-known names include Veeam, Datto SaaS Protection, Axcient, Dropsuite, and Acronis) that:

  • Backs up Exchange, OneDrive, SharePoint, and Teams automatically, typically multiple times per day
  • Stores copies outside your Microsoft tenant, so compromised admin credentials can’t reach them
  • Retains data for years, not weeks — your retention policy becomes a business decision, not a platform default
  • Restores at any granularity: one email, one file, one mailbox, or a point-in-time rollback after ransomware
  • Preserves departed employees’ data indefinitely without keeping a paid license

Cost is typically a few dollars per user per month — trivial against the value of what it protects. The same logic applies verbatim to Google Workspace.

Quick self-check

  1. If a file deleted 6 months ago were requested tomorrow, could we produce it?
  2. What happens to a mailbox and OneDrive when we offboard an employee?
  3. If ransomware synced through OneDrive on a Friday, could we roll the whole company back to Thursday?
  4. Could someone with stolen admin credentials destroy both our data and our ability to recover it?

If any answer is “no” or “not sure,” a dedicated Microsoft 365 backup belongs near the top of your IT list. It’s one of the cheapest items on it — and it turns the platform’s biggest hidden gap into a solved problem. It also slots directly into the offsite/immutable copy your 3-2-1 backup strategy calls for.