Picture this: an employee accidentally deletes a folder of client contracts from SharePoint, or a phishing email leads to a mailbox being wiped clean by an attacker. You go to Microsoft to restore everything, only to find out the data is gone for good. This happens to businesses across Greater Manchester more often than you'd think, and it usually comes down to one mistaken belief: that Microsoft 365 automatically backs up your data. It doesn't, and Microsoft has said so directly in its own service agreement.
What Microsoft actually provides
Microsoft 365 is built for uptime and infrastructure resilience, not for long-term data protection in the way most business owners assume. Microsoft's responsibility is to keep the platform running, patched and available. Your responsibility, under what's known as the shared responsibility model, is to protect the data you put into it, including emails, documents, Teams chats and SharePoint libraries.
Microsoft's own Services Agreement recommends that customers "regularly back up your content and data" using either Microsoft's tools or third-party backup apps. That's not small print buried on page 40. It's a direct statement that native retention features are not a substitute for a proper backup strategy.
Why native retention isn't backup
Microsoft 365 does have some safety nets, but they're designed for short-term recovery, not long-term protection. It's worth understanding the limits:
- Recycle bins and version history typically only hold deleted or changed items for a limited number of days, often 30 to 93 depending on the service.
- Retention policies are built for compliance and legal hold purposes, not for restoring a specific file a client needs back tomorrow.
- Litigation hold and archiving can be complex to navigate under pressure, and they don't cover every type of data loss scenario.
Once those windows close, or if someone deliberately or accidentally purges data outside of them, it's gone unless you have an independent backup.
How data actually gets lost
Most SMEs don't lose 365 data through some dramatic Microsoft outage. It happens through everyday events:
- An employee deletes files by mistake and nobody notices until after the recovery window closes.
- A leaver's account is removed before someone checks what's stored in it.
- Ransomware or a compromised account encrypts or deletes mailbox and SharePoint content.
- A sync error or a faulty app overwrites good data with bad data.
- An internal dispute leads to someone intentionally deleting records on their way out.
Any one of these can mean losing invoices, contracts, project files or years of email history, the kind of data most businesses can't afford to be without, even for a few days.
What a proper backup looks like
A genuine Microsoft 365 backup should be independent of your live tenant, meaning if your 365 account is compromised or deleted, your backup isn't affected too. It should also offer:
- Automated, regular backups covering Exchange, SharePoint, OneDrive and Teams data.
- Retention that extends well beyond Microsoft's built-in windows, often years rather than days.
- Granular restore options, so you can bring back a single email or file rather than an entire mailbox.
- Clear, tested recovery processes, so when something goes wrong, you're not improvising under pressure.
This isn't about distrusting Microsoft. It's about recognising that backup and infrastructure resilience are two different jobs, and Microsoft has been clear that the backup job belongs to you.
Protecting your business data
If your business relies on Microsoft 365 for email, documents or Teams collaboration, and most SMEs in Greater Manchester do, it's worth checking right now whether you actually have an independent backup in place, or whether you've been relying on native retention without realising its limits. Valetech Solutions helps local businesses put proper Microsoft 365 backup in place as part of a wider managed IT and cybersecurity approach, so a deleted folder or a compromised account never turns into a genuine crisis. Get in touch with Valetech Solutions to find out where your data actually stands.