Microsoft doesn't back up your data the way you think it does

A staff member tidies up and deletes a folder they’re sure nobody needs. Six weeks later, someone needs it. You’re not worried, because it’s all in Microsoft 365, and Microsoft surely keeps a copy of everything. So you go looking. And it’s gone. Permanently.

This is one of the most common and most expensive misunderstandings in small business IT. Your email, your files, your Teams chats all live in the cloud, so it feels backed up. But “in the cloud” and “backed up” are not the same thing, and the gap between them is where businesses lose data they assumed was safe.

What Microsoft actually promises

Microsoft runs on a shared responsibility model, and it’s worth understanding because almost nobody reads it. Microsoft’s job is to keep the service running: the data centres, the uptime, the infrastructure. Your data, and protecting it from deletion or loss, is your job. Microsoft’s own services agreement even spells it out and recommends you regularly back up your own content. They’re telling you, in writing, not to assume they’ve got it.

The windows are shorter than you think

Microsoft does keep deleted items for a while, but only briefly, and the clock is harsher than most people realise:

Deleted email sits in your bin and then a recoverable area for roughly two to four weeks by default, then it’s gone.
Files in SharePoint and OneDrive linger in a recycle bin for around 93 days, then they’re gone.
A departed employee’s mailbox can vanish when you remove their licence to stop paying for it, taking years of correspondence with it.

Those windows are designed to catch the “oops, deleted it yesterday” mistake. They are not a backup, because a backup is something you can still restore from in six months, not six weeks.

The risks nobody pictures

Accidental deletion is the gentle version. The ones that actually hurt:

Ransomware that syncs. If malware encrypts files on a laptop and those files sync to OneDrive or SharePoint, the encrypted versions sync up too. The cloud copy is now just as ruined as the local one.
A staff member who deletes things on the way out, on purpose or by accident, and it isn’t noticed until the recovery window has closed.
An account compromise. An attacker in a mailbox can delete and cover their tracks. By the time you’ve kicked them out, the evidence and the emails may both be gone.
Plain human error caught too late. The most common cause of all, and the one short retention windows are worst at saving you from.

How to close the gap

Get a proper backup of Microsoft 365. A separate, independent copy of your email, files, Teams and SharePoint, with retention measured in years, not weeks, and a quick way to restore exactly what you lost. This is the single fix that matters.
Know your current settings. Understand the retention you have today and turn on what you can. It won’t replace a real backup, but it widens the safety net.
Test a restore. A backup you’ve never restored from is a guess. The only one that counts is the one you’ve actually pulled data back from in a drill.

Treat your Microsoft 365 data as something you are responsible for protecting, not something protected for you. That single shift in thinking is what separates the businesses that shrug off a deletion from the ones that lose years of work.

The takeaway

Microsoft keeps the lights on. Whether your data survives a mistake, an attack, or a departing employee is on you. It’s a cheap, boring thing to fix, and it’s the kind of boring you only regret skipping once.