There is a line in Microsoft’s own documentation that most businesses have never read, and it changes how you should think about your cloud data.
Microsoft operates on a shared responsibility model. They are responsible for the infrastructure, the uptime and the availability of the service. You are responsible for your data. That is not fine print buried in an appendix; it is the stated design of the product.
Most businesses assume the opposite. It is worth understanding exactly where the line falls.
What Microsoft actually gives you
The native protections are real, and they are genuinely useful for the scenario they were built for, which is somebody deleting something and noticing quickly.
Exchange Online. A deleted item goes to Deleted Items. Empty that, and it moves to a recoverable items folder for 14 days by default, extendable to 30. Delete a user and remove their license and the mailbox is retained for 30 days before it is gone.
SharePoint and OneDrive. A two stage recycle bin, 93 days in total. File versioning, which retains previous versions of a document and is genuinely handy.
Teams. Chat and channel data live partly in Exchange and partly in SharePoint, so the coverage is inherited from both, with some gaps around specific data types.
Retention policies. If you configure them, and most organizations have not, you can hold content longer.
That is a reasonable safety net for “I deleted the wrong folder yesterday.” It is not a backup, and the difference shows up in four specific situations.
The four gaps
Time
The single most common data loss scenario in professional services is discovering months later that something is missing. A matter closes, gets archived, and eight months on somebody needs a document that was deleted in a cleanup nobody flagged.
Ninety three days does not cover that. Seven years of retention, which is what many businesses actually need for regulatory or contractual reasons, requires something else.
Departing employees
When someone leaves, the standard process is to remove their license. That starts a 30 day clock on the mailbox and, depending on configuration, on their OneDrive.
Thirty days is short. Litigation surfaces later than that. A client question about what was agreed surfaces later than that. And if the departure was contentious, deliberate deletion before handing back the laptop is a scenario every business should be able to recover from.
Ransomware and malicious administrators
This is the gap that matters most, and it is the one native retention was never designed to close.
An attacker with administrator credentials in your tenant can disable retention policies, purge mailboxes and empty recycle bins. Ransomware that encrypts a synced OneDrive folder propagates the encrypted versions to the cloud, and while versioning helps, an attacker with sufficient access can exhaust version history deliberately.
The defining property of a backup is that it is outside the reach of a compromised production environment. Native retention is inside your tenant, governed by your tenant’s administrative controls. Whoever controls the tenant controls the retention.
Migration mistakes
Tenant to tenant migrations during a merger, a mailbox conversion done wrong, a sync client that misbehaves. These produce data loss that unfolds quietly and gets noticed after the native windows have closed.
What to do
Third party backup for Microsoft 365 covers Exchange Online, SharePoint, OneDrive and Teams into storage you control, outside the tenant, with retention you set rather than retention Microsoft sets.
The things worth checking when you evaluate one:
- Retention that matches your actual obligation, not a default. If you are subject to a seven year record retention requirement, the tool needs to support that.
- Immutability, so a compromise of your production environment cannot reach the backups.
- Granular restore. Recovering a single message or a single file into its original location matters far more in practice than a full tenant restore, because single item recovery is what you will actually do, repeatedly.
- Coverage of Teams specifically, which is the piece products most often handle incompletely.
- A tested restore. The same rule as any backup: a job that reports success is not evidence that the data is recoverable. Test it.
The cost is typically a few dollars per user per month, which is small relative to almost everything else on a technology budget and to the exposure it removes.
The broader point
This is not a criticism of Microsoft. Their model is clearly documented and it is the same model every major software as a service provider uses. Google Workspace, Salesforce and Dropbox all draw the line in the same place.
The problem is that moving to the cloud feels like handing off responsibility, and for infrastructure it genuinely is. Nobody has to patch an Exchange server anymore, and that is a real gain. But data protection did not transfer with it, and the assumption that it did is one of the most common gaps we find when we take over an environment.
If you are not certain what your tenant is configured to retain, it is a quick thing to check and worth checking. Our cloud services cover tenant configuration and hardening, and backup and disaster recovery covers protecting the data itself.