“We keep everything in Microsoft 365, so Microsoft makes the backups.” We hear this sentence in almost every first conversation with a company that has moved to the cloud. It sounds logical: you pay for a service, the service runs around the clock, and your data sits in several Microsoft data centres. What more is needed?
You need to separate two things: the availability of the service and the recoverability of your data. Microsoft guarantees the first. It does not guarantee the second. This is not small print in a contract, it is an official shared responsibility model that Microsoft describes in its own documentation. The problem is that companies learn about it at the moment they need to restore a mailbox that was deleted six months ago.
In this article we explain where Microsoft’s responsibility ends and yours begins, what retention periods the platform applies by default and what a real Microsoft 365 backup looks like.
What the shared responsibility model is
The model is simple: Microsoft is responsible for keeping the service running, and you are responsible for what is in it. It is like renting a warehouse: the owner is responsible for the roof, the electricity and the lock, but not for what you put into the warehouse and what you take out of it.
On Microsoft’s side:
- physical infrastructure: data centres, servers, network;
- platform availability: keeping Exchange, SharePoint, OneDrive and Teams running;
- data replication between data centres: if one data centre fails, the service runs from another;
- platform security: making sure nobody breaks into Microsoft’s own infrastructure.
On your side:
- data: emails, files, calendars, Teams chats and their recovery;
- accounts and access: who can reach what, passwords, two-factor authentication;
- human error: accidental deletion, overwriting, incorrect sharing;
- insider threats: a disgruntled employee, a departing colleague who “tidies up” their mailbox;
- external threats: phishing emails, compromised accounts, ransomware reaching OneDrive through sync.
Replication between data centres is often confused with backup. The difference is fundamental: replication copies everything, including your mistakes. If an employee deletes a folder, it is deleted instantly in every Microsoft data centre. If ransomware encrypts files in OneDrive, the encrypted versions sync just as reliably.
What Microsoft will not restore for you
A few scenarios we run into all the time.
Deleted emails past the retention period
A deleted email first lands in the Deleted Items folder. When it is deleted from there, it goes to the Recoverable Items folder, where by default it is kept for 14 days, and an administrator can extend this to 30. After that the email is gone permanently. For an accountant who needs a September email with an invoice attachment in January, Microsoft support cannot help.
Encrypted OneDrive and SharePoint files
OneDrive keeps file versions and has a recycle bin where items are held for 93 days. That helps with a single document overwritten by mistake. But when ransomware encrypts tens of thousands of files through the sync client, restoring versions one by one, or even a bulk rollback with the “Restore your OneDrive” feature, works only for 30 days and only if versioning was not turned off or exhausted.
Former employees’ accounts
The most common painful case. An employee leaves, the licence is expensive, the administrator removes it and deletes the account. Microsoft keeps the account and all its data for another 30 days. After that, nothing. Three months later it turns out that only that mailbox held the correspondence with an important supplier, or that the OneDrive folder held project files nobody else had.
Teams chats and shared channels
Teams chats actually live in Exchange and SharePoint, but restoring them with standard tools is even harder than restoring emails. A deleted channel or team has its own time limits, and from a recovery point of view the chat content often remains in a “grey zone.”
Retention periods in one place
| What was deleted | How long it can still be restored with standard tools |
|---|---|
| An email from Deleted Items | 14 days (up to 30 if the administrator extended it) |
| A file from the OneDrive or SharePoint recycle bin | 93 days |
| A deleted user account with all its data | 30 days |
| Bulk OneDrive restore after encryption | 30 days |
All of these periods protect against a mistake noticed quickly. None of them is a backup. A backup means you can restore data a year later, from a point before the incident, regardless of whether anyone noticed the problem and when. Retention policies in a Microsoft 365 tenant can help with legal requirements, but they keep data on the same platform, behind the same administrator access. If an administrator account is taken over, they can be switched off.
What a real Microsoft 365 backup looks like
We use Veeam Backup for Microsoft 365. The principle:
- Everything is backed up: Exchange mailboxes, OneDrive, SharePoint sites and Teams data.
- Backups are stored outside the Microsoft platform, in our data centre in Lithuania (EU) and, if you need it, also in an Amazon data centre in Germany. A Microsoft platform incident or a compromised administrator account does not reach the backups.
- You set the retention period: one year, three, as long as your business or accounting rules require.
- Recovery goes down to a single email, a single file, a single calendar item. You do not need to restore a whole mailbox to find one attachment. You can restore to the same account, to a different account or download as a file.
- Former employees’ data stays in the backups after the account is deleted, so the licence can be removed right away instead of being kept “just in case.”
We describe this in more detail on the Microsoft 365 backup service page. Note that a backup solves the recovery question, not the access question: a compromised account sending phishing emails to your customers is a different problem, handled by Microsoft 365 security measures such as two-factor authentication, Conditional Access and alerts on suspicious sign-ins.
What NIS2 and DORA say about it
If your company falls within the scope of NIS2 or DORA, the question “who is responsible for Microsoft 365 data” becomes a compliance question rather than a technical one. Both frameworks treat service providers as a risk that has to be managed, not transferred. “The data is with Microsoft, so it is safe” is not an answer for an auditor. The answer is a documented backup policy, retention periods, restore test records and a clearly named person responsible.
Where to start
- Check how many days your Exchange keeps deleted items and extend the period to 30 days. It costs nothing and buys you time.
- List the accounts of employees who left in the last month and were deleted, and whether anyone still needs their data. If so, restore it now while you still can.
- Decide how long your company needs to keep emails and files. The answer is usually dictated by accounting and contracts, not by IT.
- Deploy a separate backup solution outside the Microsoft platform and restore at least one email and one OneDrive folder, so the procedure is tested.
- If you want us to do this, write to us through the contact form. The first Microsoft 365 backup usually starts running the same day we get access.
