Does Microsoft 365 back up your data?

Ask a firm whether its email and documents are backed up and the usual answer is, "They're in Microsoft 365, so yes." It's a reasonable assumption. It's also where a lot of firms get caught out.

What Microsoft and Google do

They keep the service running. Your data is stored in more than one place so that a failed disk or a data center outage doesn't lose it. That's protection against their problems.

It isn't protection against yours.

What they don't do

Their copies mirror your account. Whatever happens in your account happens in every copy.

• Someone deletes a folder. It goes to a recycle bin, and after a set period it's gone for good. If nobody notices in time, there's nothing to restore.
• Ransomware encrypts your files. The encrypted versions sync to the cloud and replace the good ones.
• A departing employee clears out their mailbox, or their account is deleted to free up a license and the data goes with it.
• An attacker gets into an account and deletes or alters what they find.

In each case the service is working exactly as designed. It did what your account told it to do.

Both companies describe this as a shared arrangement: they are responsible for the service, and you are responsible for your data. The built-in tools for keeping deleted items and old versions help, but they have time limits and they weren't built to be a backup.

What a real backup adds

A backup is a separate copy, held somewhere your account can't reach, that keeps earlier versions for as long as you choose.

That gives you three things the built-in tools don't:

1. A copy an attacker can't delete by getting into a mailbox.
2. History. You can restore a file as it was last Tuesday, or a mailbox as it was before someone left.
3. A restore you control, for one file or for everything.

What to back up

• Mailboxes, including shared ones.
• Files in OneDrive, SharePoint or Google Drive.
• Calendars and contacts.
• Each computer, for anything saved locally.

How to know it works

Restore something. Pick a file each quarter, restore it, and note that you did. A backup nobody has tested is an assumption.

Why this matters for a professional firm

Your files are your work product and your clients' records. Losing a client folder is a professional problem, and you may be asked to prove you can recover. It's one of the first things a cyber insurer asks, as we cover in what cyber insurers ask.

Backup of Microsoft 365 or Google Workspace is included from our Business plan. See backup and recovery, or price it for your headcount in the plan builder.