Moving to Microsoft 365 solved a lot of problems for law firms: no more aging mail servers, easy collaboration and access from anywhere. It also created a belief that has caused real trouble: "Microsoft backs it all up, so we do not have to."
The truth is more nuanced. Microsoft runs a resilient service, but its responsibilities and yours are not the same. Here are five common myths and what to check instead. Retention features and licensing change over time, so confirm current details with Microsoft documentation and your provider.
Myth 1: "Microsoft Backs Up Our Data for Us"
Reality: Microsoft is responsible for keeping the service available and protecting the infrastructure. Its shared responsibility model places responsibility for your data, including access, retention and recovery from user error or malicious deletion, largely with you. Built-in features such as recycle bins and version history help with short-term mistakes but are not a full backup.
What to do: Ask your provider what retention settings are in place and how long deleted items can be recovered.
Myth 2: "Deleted Means Recoverable"
Reality: Recovery windows for deleted email, files and sites are limited. When a mailbox is deleted, or a user empties a recycle bin, the clock starts. After the window closes, items may be gone for good. An employee who leaves and whose account is removed can take years of matter email with it if retention was not configured.
What to do: Define retention for departed users' mailboxes and files, and preserve them before removing accounts.
Myth 3: "Ransomware Can't Touch the Cloud"
Reality: Files synced from computers to cloud storage can be encrypted at the source, and the encrypted versions may sync up and overwrite good copies. Version history may let you roll back, but doing so at scale takes planning and time. An attacker who compromises an administrator account can also delete or alter data directly.
What to do: Protect administrator accounts with strong MFA, and keep an independent backup in a separate environment that compromised credentials cannot reach.
Myth 4: "Our Practice-Management and Document Vendors Have It Covered"
Reality: Specialized legal platforms generally maintain their own backups for disaster recovery of their service, but their terms often limit what they will restore for an individual customer, and at what cost or delay. Some do not restore individual deleted matters.
What to do: Read the terms or ask directly: if one of our attorneys deletes a matter by mistake, can you restore it? How far back? How long does it take? Consider scheduled exports of key data to storage you control.
Myth 5: "Litigation Hold and Retention Settings Equal Backup"
Reality: Retention and hold features preserve data for compliance and legal purposes. They serve a different purpose from backup. They may not restore a mailbox structure quickly, may be complex to search and can be changed by administrators. Using them well requires careful configuration.
What to do: Use retention and legal-hold tools for what they are good at, and use a true backup for rapid, point-in-time recovery.
What a Real Cloud Backup Provides
A third-party backup for Microsoft 365 typically offers:
- Copies stored in a separate environment
- Longer retention than default settings
- Point-in-time restore of mailboxes, calendars, files and sites
- Granular recovery, such as a single message or folder
- Protection that does not depend on the same administrator credentials
Questions to Ask Your IT Provider
- Which Microsoft 365 data is backed up: email, OneDrive, SharePoint, Teams?
- Where do the backups live, and who can delete them?
- How long are they kept?
- How quickly could we restore one mailbox? The whole tenant?
- When was the last restore test?
- Is access to the backup protected with MFA and separate credentials?
Test a Scenario
Pick a realistic one. An assistant deletes a client's shared folder in error and discovers it three weeks later. Can you get it back? How long does it take? If the answer is unclear, you have found your gap.
Why It Matters Ethically
Model Rule 1.1 and its comment on technology, and the duty to safeguard client property and information, suggest that firms should understand what happens to client data in the systems they choose. Not knowing is hard to defend if client files are lost. Check your state bar's guidance on file retention and safeguarding.
Make It Routine
Add backup review to your quarterly IT meeting, review retention when offboarding users and test a restore regularly.
Counsel Cyber configures and monitors Microsoft 365 backup for law firms and tests restores on a schedule. If you are not sure what your current setup would recover, we can check.