Microsoft does not back up your email: shared responsibility explained for SMBs

“Our email is in the cloud, so it is backed up.” We hear this sentence at every audit. It is wrong, and Microsoft says so in its service agreement: the vendor guarantees platform availability, not the retention of your data. That is the shared responsibility model.

What Microsoft guarantees

Microsoft commits to the infrastructure: datacenters, replication across regions, 99.9% availability. If a datacenter fails, your mailboxes stay reachable from another. That resilience is real and far better than a local server.

What Microsoft does not guarantee

Your data remains your responsibility. A few concrete situations the Microsoft 365 recycle bin does not cover:

• Permanent deletion. A deleted item stays 30 days in the recycle bin, 14 more in admin recovery, then it is gone. An employee who empties the bin on the way out erases three years of customer history.
• Ransomware. An encrypted laptop syncs encrypted files to OneDrive and SharePoint. Version history helps, provided it was enabled and the attacker did not purge it.
• Deleted account. Removing a licence deletes the mailbox after 30 days. Without a backup, everything is lost, including anything under a legal retention duty.
• Admin error. A misconfigured retention policy applies tenant-wide with no undo.

Native retention, available in Business Premium and E3, covers some cases but is not a backup: it lives in the same tenant with the same credentials, and a compromised admin can switch it off.

What a real Microsoft 365 backup brings

A third-party backup copies Exchange, OneDrive, SharePoint and Teams every day to storage independent of the tenant. It lets you:

• restore a message, a folder or a whole mailbox to a given date, in minutes;
• keep data beyond Microsoft’s 90 days, for a retention duty or a dispute;
• survive a compromised admin account, since backup storage is not reachable with Microsoft credentials.

We deploy Veeam Backup for Microsoft 365 with immutable object storage, often the same used for server backups. The principle is the 3-2-1 rule we detail in our article on immutable backup.

What it costs

For a 30-user SMB, count a few dirhams per user per month, licence and storage included. Compare that with a single day without email, or a customer history that cannot be recovered.

Where to start

1. Check your current settings: recycle bin duration, OneDrive version history, whether retention is active.
2. List critical data: leadership mailboxes, shared addresses, SharePoint libraries holding contracts.
3. Set up a daily backup, test a restore, and document who can trigger it.

Those three steps fit in half a day. They are part of our managed cloud offer, with a restore test included every quarter.