Microsoft 365 is not a backup

A sentence we hear often: “our email is in Microsoft 365, so it is backed up.” It is a reasonable assumption and it is wrong in three specific ways.

The bin is not a backup

Deleted items in Exchange Online are recoverable for a limited window — 30 days by default, longer if you pay for a higher retention tier. That covers the accidental deletion. It does not cover the case where a mailbox is compromised, a sync tool propagates a bad state across every device, or a departing employee deletes on the way out. Recoverable-for-30-days is a convenience feature, not a backup.

Microsoft’s uptime promise is not your data promise

When Microsoft publishes an availability figure, it is a statement about the service being up. It is not a statement that your data can be restored to a point in time you choose, or restored at all if you leave. The shared responsibility model puts the data on you; Microsoft’s job is to keep the platform running.

What a real backup looks like

A genuine backup of Microsoft 365 is a third-party copy, held outside the tenant, that you can restore from without Microsoft’s cooperation. In practice that means:

• A separate destination — a cloud-to-cloud backup service, or a NAS in your own office that the data is copied to nightly.
• A retention window you chose, not one you inherited. Six months to a year is typical for records you may be asked to produce.
• A restore you have actually tested. A backup that has never been restored is a hypothesis.

What it costs

For most SMEs this is a per-user monthly fee, considerably less than the licence itself. It is also the difference between a bad afternoon and a bad quarter.

If you are not sure whether you have this in place, ask us and we will check what the tenant is actually configured to retain.