A common assumption is that data in Microsoft 365 is automatically backed up. Microsoft ensures the service is available; protecting your data from deletion, corruption or ransomware is largely your responsibility.
What Microsoft covers — and what it doesn’t
Native features such as retention policies and recycle bins help, but they are not designed as an independent, long-term, point-in-time backup that sits outside the tenant.
Risks to plan for
- Accidental or malicious deletion beyond retention windows
- Ransomware syncing encrypted files to OneDrive and SharePoint
- Compromised admin accounts deleting data
- Long-term retention and legal requirements
What good looks like
An independent backup of Exchange, OneDrive, SharePoint and Teams, stored outside the tenant, with immutability and regular restore tests.
Choosing an M365 backup approach
- Coverage of Exchange, OneDrive, SharePoint and Teams, including chats and channels where required
- Granular restore of individual items as well as full mailboxes and sites
- Storage outside the Microsoft 365 tenant, with immutability
- Retention aligned to legal and compliance needs
- Separate administrative credentials from the M365 global admin accounts
Test restores regularly, including a scenario where a compromised administrator has deleted data — that is the situation independent backup exists for.
Key takeaways
- Availability is not the same as backup.
- Keep an independent, immutable copy outside the tenant.
- Test restores of mailboxes, sites and Teams data.
Want an independent view of your recoverability?
Book a Recovery Readiness Call and we’ll help you turn assumptions into evidence.
