It’s one of the most common misconceptions we encounter when onboarding new clients: “We’re backed up — everything is in Microsoft 365.” Unfortunately, this belief leads many businesses to discover the hard way that Microsoft 365 is not a backup solution, and that data loss is entirely possible despite paying for Microsoft 365 every month.
What Microsoft 365 Actually Provides
Microsoft’s shared responsibility model is clearly documented, but rarely read. Microsoft is responsible for keeping the Microsoft 365 service running — the infrastructure, availability, and durability of their datacentres. You are responsible for your data.
Microsoft 365 does include some data retention capabilities: Exchange has a Deleted Items folder and a Recoverable Items folder; SharePoint and OneDrive have version history and a recycle bin. But these are not backups — they’re limited retention mechanisms with important constraints.
Scenarios That Can Cause Permanent Data Loss in Microsoft 365
- Accidental deletion beyond the retention window — Exchange Recoverable Items retains deleted emails for 14 to 30 days (depending on configuration). After that, they’re gone permanently unless litigation hold is configured.
- Ransomware syncing to the cloud — if a workstation is compromised by ransomware and files are synced to OneDrive or SharePoint before encryption is detected, the encrypted files sync too, overwriting good versions. Version history may help recover some files, but ransomware designed to target cloud sync specifically can exhaust version history as well.
- Malicious deletion by a disgruntled employee — an employee with appropriate permissions can delete entire SharePoint libraries or OneDrive contents. While some recovery is possible, it’s not guaranteed.
- Third-party app errors — integrations and apps connected to your Microsoft 365 tenant can inadvertently delete or corrupt data. This is more common than most businesses realise.
- Account deletion without data export — when a user account is deleted (for example, when an employee leaves), their OneDrive data is retained for only 30 days by default before permanent deletion.
What a Proper Microsoft 365 Backup Looks Like
A dedicated third-party backup solution for Microsoft 365 takes point-in-time snapshots of your Exchange mailboxes, SharePoint libraries, OneDrive files, and Teams data — typically daily or more frequently — and retains them independently of Microsoft’s infrastructure. This means you can restore a specific version of any file or email from any point within your retention window, regardless of what happened in Microsoft 365.
Kinsoft provides Microsoft 365 backup as part of our cloud backup service, using Acronis Cyber Protect to protect all Microsoft 365 data — Exchange, SharePoint, OneDrive, and Teams — with 90-day retention as standard. Restoration is fast: individual emails, files, or entire mailboxes can be restored within minutes.
The Cost of Not Having a Backup
Microsoft 365 backup typically costs $3–$5 per user per month — less than a coffee. The cost of a data loss incident that requires emergency recovery (if recovery is even possible), business downtime, client impact, and potential regulatory breach notifications is orders of magnitude higher. It’s one of the clearest ROI cases in IT.
Talk to Kinsoft about protecting your Microsoft 365 data. Contact us or call 02 9064 2663.