A common belief among law firms is that because their email and files live in Microsoft 365, they are automatically backed up. The reality is more nuanced. Microsoft provides a highly available service and several retention and recovery features, but its terms describe a shared-responsibility model in which customers are responsible for their own data. Understanding the difference between built-in retention and an independent backup can prevent an unpleasant surprise.
Product features and plan details change, so confirm current specifics in Microsoft's documentation for your licenses.
Availability is not backup
Microsoft works to keep services running and replicates data across data centers so a hardware failure does not take your mailbox offline. That is availability. It does not protect you from:
- A user or administrator deleting data, accidentally or on purpose
- Ransomware or malicious scripts that encrypt or delete synchronized files
- A compromised account, in which an attacker deletes mail or files
- Software errors or misconfigurations that overwrite content
- Retention periods that expire before anyone notices the loss
Cloud synchronization can also propagate damage. When files in OneDrive are encrypted by malware on a laptop, the encrypted versions may sync to the cloud.
What Microsoft's built-in features offer
Typical protections include recycle bins, recoverable items folders, version history and some retention policies. These help with ordinary mistakes. Some key limitations to understand:
- Deleted items are generally recoverable only for a limited time.
- Recycle bin recovery is tied to the user's actions and the time window.
- Retention policies and legal holds are designed for compliance and preservation, not for restoring an environment after a disaster.
- When a user account is deleted, associated data may be removed after a defined period.
- Restoring large volumes of data after a mass deletion can be difficult without dedicated tools.
Some plans include additional features such as file-restore capabilities for OneDrive and SharePoint within a limited window. Check what yours includes and for how long.
Retention versus backup
A useful way to think about it:
- Retention keeps content so it can be found and produced later. It serves compliance, discovery and records management.
- Backup creates separate, independent copies that can be restored to a chosen point in time, even if the original and its retention copies are damaged or deleted.
Law firms need both. Litigation holds preserve evidence. Backups protect against loss and sabotage.
What to protect
A complete plan covers more than email.
- Exchange Online mailboxes, including calendars and contacts, and shared mailboxes
- OneDrive for Business files
- SharePoint sites and document libraries
- Microsoft Teams chats, files and channel content
- Entra ID (directory) configuration, including groups and conditional access policies, since rebuilding these after an incident is slow
- Intune or device management settings, if used
What to look for in a third-party backup
- Independence. Stored outside your Microsoft tenant and protected by separate credentials with MFA.
- Immutability. Copies that cannot be altered or deleted during a retention period.
- Frequency. Several backups per day for critical data where available.
- Granular recovery. Restoring a single email, folder, site or user, not just entire mailboxes.
- Point-in-time restore to roll back before an incident.
- Retention and security options that match your records policy.
- Encryption and data location that suit your confidentiality requirements.
- Reporting and alerts for failed jobs.
- Clear pricing, since costs usually scale by user.
Testing
As with any backup, test restoring a deleted mailbox, a SharePoint library and a OneDrive folder regularly, and record how long each takes. Include a scenario in which an administrator account is compromised.
Document management platforms
If your firm uses NetDocuments, iManage or a similar platform, ask your vendor about their backup and recovery arrangements and whether you can obtain independent exports. The Microsoft question applies to every cloud service you rely on.
Cost versus risk
Backup for Microsoft 365 is generally priced per user per month, and for a small firm it is modest compared to the cost of losing years of email. Consider the potential consequences for client files, billing records and deadlines.
Ethical dimension
Model Rule 1.1 Comment 8 asks lawyers to understand the benefits and risks of the technology they use, and Rule 1.6(c) addresses reasonable efforts to protect client information. Knowing exactly what your cloud provider does and does not back up is part of that understanding.
Counsel Cyber can review your Microsoft 365 retention settings, identify gaps and implement independent backup with tested recovery for your firm.