Many firms assume that because their email and documents live in Microsoft 365, they are automatically backed up. That is a common and understandable belief, and it is only partly right. Microsoft is responsible for keeping the service available and its infrastructure resilient. Protecting your data from your own mistakes, from malicious deletion, or from an attacker who has taken over an account is a shared responsibility, and a large part of that responsibility falls on you.
Read Microsoft's current service agreement and documentation for the details, since terms and features change. What follows is a practical framework for understanding the gap.
The difference between availability and backup
Availability means the service is up and your data is replicated across Microsoft's systems so a hardware failure does not take it away. Backup means you can recover a specific item from a specific point in time, including after it was deleted or altered.
Replication copies mistakes. If someone deletes a mailbox, or ransomware encrypts files that sync to OneDrive, the damage replicates too. Built-in features like recycle bins, version history, and retention settings help, but they have time limits and can themselves be purged by someone with sufficient access.
Scenarios where firms get hurt
- Accidental deletion: an assistant clears a shared folder and the recycle bin is emptied past its retention window
- Malicious insider or departing employee: someone deletes matter folders on the way out
- Compromised account: an attacker deletes mail and files, or encrypts synced documents
- Sync errors: a bad sync overwrites good files with old or corrupted versions
- Retention misunderstandings: a user license is removed and the account's data is deleted after a grace period
- Litigation and discovery needs: you need data from a specific date that standard retention no longer holds
What the built-in tools can do
Microsoft 365 includes features that help, depending on license:
- Recycle bins and recoverable items with time limits
- Version history for files in SharePoint and OneDrive
- Retention policies and litigation hold, which preserve content for compliance but are not the same as point-in-time restore
- Restore options for OneDrive after mass changes, within a window
Ask your IT provider which of these are enabled in your tenant and what their time limits are. Retention for legal and compliance reasons is a different goal from operational recovery.
What third-party backup adds
A dedicated backup service for Microsoft 365 typically stores copies of mail, calendars, contacts, SharePoint, OneDrive, and Teams data in a separate location, with retention you control and granular restore. When evaluating one, ask:
- What workloads are covered: Exchange, SharePoint, OneDrive, Teams, and others?
- How often does it back up, and what is the realistic recovery point?
- Is the backup stored outside your Microsoft tenant and protected from deletion by your admins?
- Can you restore a single mailbox, folder, or file, and how fast?
- How is access to the backup secured, with MFA and separate credentials?
- What are the retention options, and how does pricing change as data grows?
- Can you test restores easily?
Policies and process matter too
Control who can delete at scale
Limit administrative roles, require MFA for them, and alert on mass deletions or unusual download activity.
Handle departing employees carefully
Before removing a license or deleting an account, convert the mailbox to a shared one or archive it according to your retention policy. Document when data can be purged.
Align retention with your obligations
Work with partners on how long client files and email must be kept under your engagement letters and applicable rules. Check your state bar's guidance. Then set retention to match, rather than leaving defaults in place.
Test restores
As with any backup, a restore you have never tried is an assumption. Test mailbox and file restores at least quarterly and note how long they take.
Do not forget identity
Your Microsoft 365 configuration itself, including conditional access policies, groups, and permissions, is part of what you would need to rebuild after an attack. Document it, and consider tools that export or snapshot configuration.
Cost versus risk
Backup for cloud services usually costs a modest amount per user per month. Weigh that against the cost of losing a matter's email history or a shared drive during a dispute.
Our role
Counsel Cyber reviews Microsoft 365 tenants for law firms, including retention settings, admin roles, and backup coverage, and can recommend and manage backup solutions. If you are unsure what would happen if a user's data vanished tomorrow, we can help you find out before it matters.