Imagine discovering that a SharePoint folder was deleted months ago. The service still works, but the files your team needs may be outside the available recovery window. The question is whether your organization has a recoverable copy from the right point in time.
Microsoft 365 includes recovery features, and additional backup options are available. The useful comparison is what each option protects, how long it keeps recovery points and what it can restore in the situations your business needs to handle.
Keeping the service running is only part of the picture
Microsoft 365 follows a shared responsibility model. Microsoft handles the service and its infrastructure, including data centres, replication, availability and resilience. Replication means maintaining technical copies that help the service continue operating through failures. Those copies do not, by themselves, give your business an independent backup from before a deletion.
Your business is responsible for protecting its data against accidental or malicious deletion, ransomware, compromised accounts, malicious insiders and gaps in retention. A mailbox can be available and working normally even after someone has removed the messages you need.
Microsoft’s service level agreement concerns uptime, with service credits as the remedy. It is not a promise to restore deleted data. Microsoft’s agreements place responsibility for your data on you and limit its liability. Review the agreement that applies to your organization; business customers generally use the Microsoft Customer Agreement or similar terms.
Built-in recovery has a time limit
Native recovery features can help when someone catches a mistake quickly. Problems arise when a deletion goes unnoticed or the business assumes that recovery options last longer than they actually do.
- Exchange Online: deleted items remain recoverable for 14 days by default. An administrator can configure that period up to 30 days.
- SharePoint and OneDrive: the first-stage and second-stage recycle bins retain items for 93 days in total. Moving through both stages does not restart that period.
- A departed employee’s OneDrive: the default retention period is 30 days after the account is deleted. An administrator can change that period, and applicable retention settings need to be checked.
These are recovery windows for particular situations. They are not a general assurance that every email and document will remain recoverable whenever you discover a problem. Ask your IT provider to confirm the settings in your own environment rather than relying on what you remember from the initial setup.
Retention and synchronization serve different purposes
Retention policies and litigation hold preserve information so that it can be searched or maintained for compliance purposes. They can be important parts of information management, but they do not put an entire mailbox or SharePoint site back the way it was yesterday in one action.
A backup is intended to support recovery after data loss or an incident. Depending on the solution, you can select an earlier copy and restore the content you need. Preserving information for a search and restoring a working environment are different tasks.
Synchronization also needs to be understood separately. It keeps files up to date across locations. If ransomware makes local files unreadable and those changes synchronize to OneDrive, the cloud files may reflect the same problem. A synchronized copy is not necessarily an independent recovery copy. Any backup you choose should be assessed on what it can actually restore.
Everyday situations can become recovery problems
An employee deletes a folder while tidying up shared documents. Nobody notices until the client returns several months later. At that point, SharePoint may be operating perfectly, but the recycle-bin window may have passed. The business needs an older copy that still contains the folder.
In another situation, an attacker gains access to an account and empties its mailbox. The business needs to secure the account and recover the missing messages. If the same compromised administrative accounts also control the backups, that creates another concern to examine.
Ransomware presents a different recovery challenge. Encrypted versions of files may synchronize from a computer to OneDrive. The business then needs a usable copy from before the incident and a clear process for restoring it.
Employee departures deserve attention too. Removing a licence and deleting an account are sometimes handled as one administrative task, but they are distinct actions. Licence removal should not be confused with the account deletion that starts the OneDrive retention period described above. Plan the transfer and protection of business files before closing out an employee’s access.
Check exactly what the backup covers
Microsoft now offers a paid add-on called Microsoft 365 Backup, and third-party Microsoft 365 backup services also exist. Start with the information your business needs to recover, then compare each option against those requirements.
Ask for a clear coverage list that addresses:
- Exchange email, calendars and contacts;
- OneDrive files and folders;
- SharePoint documents and sites;
- Teams conversations and files, whose underlying data is spread across services including Exchange and SharePoint.
A statement such as “Teams is backed up” needs more detail. Which content is included, and what will it look like after recovery? Ask the provider to explain any exclusions in language your office manager can understand.
Check granular restore as well. This means recovering a specific item, such as one email, file or folder. Your business may also need to restore a whole mailbox or site. Confirm both the smaller recovery tasks and the larger ones that matter to your operations.
Look at storage, access and retention together
Assess how backup storage is separated from your production tenant, meaning the Microsoft 365 environment your employees use every day. Ask where the copies live, who can delete them and whether backup administration relies on the same accounts used to manage your main environment.
Choose a retention period that fits your business needs and obligations. Some folders are opened every day; others are needed only when a contract comes up for renewal. That affects how long a deletion could go unnoticed and how far back you may need to recover.
If Canadian data residency is a requirement, confirm where backups and secondary copies are stored. This should be an explicit part of the discussion rather than an assumption based on a provider’s office location.
Protecting personal information in backups also belongs in your broader Loi 25 considerations. Limit access and give retention deliberate thought. Having a backup is one protective measure; it does not, on its own, establish compliance.
Assign responsibility and test a restore
Someone needs to monitor the backup after it is enabled. Establish who checks failures, confirms that new accounts are covered and reviews changes to the scope of protection. Also decide who can authorize a restore and who will keep affected employees informed.
A restore test checks whether a saved copy can actually be recovered and used. Try an email, a folder and, where relevant, a larger set of information. Check the recovered content, where it lands and whether the right people can access it.
A backup review should establish what is protected, how long recovery points remain available and who handles a restore. We can include that review in the managed-service or consulting scope agreed with your business.
Microsoft 365 supports everyday work, while backup requires its own decisions. Clear settings, assigned responsibilities and tested recovery give your business a more dependable way to handle missing or damaged information.
To make backup part of your ongoing IT planning, explore our managed IT services or contact our team to discuss your Microsoft 365 environment.
