Ask a firm administrator whether the firm's email and files are backed up, and the answer is often, "They are in Microsoft 365, so yes." It is an understandable assumption. Microsoft runs enormous, redundant data centers, and files in the cloud feel safer than files on an old server.
But availability and backup are different things. Microsoft's own service terms describe a shared responsibility model: Microsoft is responsible for running the service, while the customer remains responsible for its data and for how it is accessed and protected. Details of retention features change, so confirm current specifics with Microsoft's documentation or your IT provider. The principles below hold regardless.
Availability is not the same as backup
Microsoft works to keep Exchange Online, SharePoint and OneDrive up and running even if a server fails. That protects you from hardware failure on Microsoft's side. It does not necessarily protect you from the things that most commonly cause data loss:
- Accidental deletion by a user or administrator.
- Malicious deletion by a departing employee.
- Ransomware or malicious sync, where encrypted or corrupted files replicate to the cloud.
- Account compromise, where an attacker deletes mail or files.
- Retention expiry, where deleted items are permanently purged after a limited window.
- Mistaken configuration, such as a retention policy that deletes more than intended.
What built-in features provide
Microsoft 365 includes several recovery features, such as recycle bins, version history and retention settings. They are useful, but they have limits.
Recycle bins and recoverable items
Deleted files and emails typically move to recycle bins or recoverable item folders for a limited period. After that, they may be permanently removed. Administrators and attackers with sufficient access may also be able to purge items sooner.
Version history
Document libraries can keep earlier versions of files, which helps with accidental edits. Version limits and retention settings affect how far back you can go. Mass encryption by ransomware can burn through versions.
Retention policies and litigation hold
Retention and hold features, depending on licensing, are designed for compliance and preservation, not as a general-purpose backup system. They can preserve content even when users delete it, but they are not the same as a point-in-time restore of an entire mailbox or site to a prior date.
Microsoft's recovery options
Microsoft offers limited restoration options for certain scenarios, such as restoring a site collection or OneDrive to an earlier point within a defined window. These have time limits and conditions. Do not plan to rely on a support case during an emergency.
Why this matters for law firms
Email and documents are the core records of a law practice. Losing a mailbox could mean losing client communications, deadlines and evidence of advice given. Firms also face retention obligations for client files and potential preservation duties during litigation. The ABA's Model Rule 1.1 Comment 8 asks lawyers to understand the benefits and risks of the technology they use, and understanding what your cloud provider does and does not back up is part of that.
What a real backup for Microsoft 365 includes
A third-party backup service designed for Microsoft 365 typically offers:
- Independent storage. Copies live outside your tenant, so a compromised administrator account cannot erase both.
- Scheduled, frequent backups of mailboxes, calendars, contacts, SharePoint sites, OneDrive and Teams data.
- Point-in-time restore at the item, folder or whole-account level.
- Longer or configurable retention aligned to your firm's retention policy.
- Immutability options to resist deletion by attackers.
- Audit and reporting of backup success and restore activity.
Questions to ask your IT provider
- Which Microsoft 365 services are currently backed up, and by what?
- Where are the copies stored, and who can delete them?
- How long are backups retained?
- When did we last restore a mailbox or SharePoint site as a test?
- What is our plan if an administrator account is compromised?
- How do backup retention settings interact with our client file retention policy and legal holds?
Do not forget the rest of the stack
Practice management, document management and other cloud platforms deserve the same questions. Check what the vendor offers for recovery and whether the firm should export data periodically.
Cost and effort
Backing up Microsoft 365 is typically a modest per-user monthly cost compared with the value of the data. The larger effort is configuration and testing, not the software license.
A quick start
- Confirm what is currently protected.
- Choose a backup approach that stores copies independently with immutability.
- Align retention with your file retention policy.
- Run a restore test within the first month and then quarterly.
- Document the process and keep the instructions offline.
Counsel Cyber provides Microsoft 365 backup and recovery for law firms and tests restores regularly. If you are unsure what you have today, we can check your tenant's configuration and explain exactly what would and would not be recoverable.