If you knew how many businesses I've sat across the table from who genuinely believe Microsoft is backing up their data, it would make your head spin. CEOs, CFOs, operations directors — smart people running real companies — all operating under the same dangerous assumption: "We're in the cloud. It's backed up."
It's not. And I need you to hear that clearly.
Microsoft is not backing up your data. Their own documentation says so. Their retention policies are not backups. They are a convenience feature with an expiration date. And when that date passes, your files are gone. Permanently.
What Just Happened to a Real Client
I'm writing this because it just happened. A client — a sizable company with a lot of employees and a lot of files — had data deleted from SharePoint. Nobody noticed for over 30 days. That's not unusual. People are busy. Files live in nested folders. Someone deletes a directory and nobody realizes it until someone goes looking for something specific weeks later.
Here's where it gets ugly. After 30 days, Microsoft's recycle bin purges. And once that happens, there is no bulk restore. You can't just click "restore all" and get your folder structure back. You have to recover files one at a time. Individually. Out of nearly a thousand deleted files.
Let me paint that picture for you. Imagine sitting down at your computer and manually restoring files, one by one, with no folder structure, no hierarchy, no context — just a flat list of file names. Now do that 1,000 times. And hope you don't miss anything. And hope you can figure out where each file was supposed to live.
That's the reality Microsoft leaves you with.
We Restored Everything in Minutes
Because we run independent, offsite backups of every client's Microsoft 365 environment — SharePoint, OneDrive, Exchange, Teams — we restored the entire thing. Full folder structure. Every file. Back where it belonged. Minutes, not days.
That's not a sales pitch. That's just what happened. And it only happened because we made a decision years ago that Microsoft's built-in retention is not a backup strategy. It's a liability disguised as a feature.
Most MSPs Don't Do This
I know they don't, because I meet with their clients all the time.
I sit down with business owners who are paying $150, $200, $300 per user per month to a managed service provider, and when I ask "who's backing up your Microsoft 365 data?" I get blank stares. Or worse — "our MSP handles that." And when we dig in, the answer is nobody. Nobody is backing it up. The MSP assumed Microsoft had it covered. Or they knew better and just didn't want to spend the money.
Independent Microsoft 365 backup costs money. Not a lot of money — but it's a line item. And in an industry where providers compete on price and clients don't know what to ask for, that line item gets cut. Every time. Because the client doesn't know to demand it, and the MSP doesn't volunteer to add cost to their proposal.
So it doesn't get done. And nobody finds out until something goes wrong.
Microsoft Will Tell You This Themselves
This isn't some fringe opinion. Microsoft's own shared responsibility model makes it clear: they are responsible for infrastructure availability. You are responsible for your data. They keep the lights on. You keep your files safe.
They provide retention policies and recycle bins as a convenience. But those aren't backups. A backup is an independent copy of your data, stored separately, that you can restore from at any point in time. What Microsoft gives you is a 30- to 93-day window where you might be able to recover something — if you catch it in time, if you know where to look, and if the retention policy hasn't already purged it.
That's not a backup. That's a hope and a prayer.
The One Question You Need to Ask Today
I'm not trying to sell you anything here. I don't know who your IT provider is and I don't need to. But I am telling you — as someone who has seen this exact scenario play out more times than I can count — you need to ask your provider one question today:
"Do you back up our Microsoft 365 data independently? And if so, show me the last restore test."
If they say yes and can show you a recent restore, great. You're in good hands. Most businesses aren't.
If they hesitate, deflect, or say "Microsoft handles that" — you have a problem. A big one. And you need to fix it before you end up staring at a thousand deleted files with no way to get them back.
This Is the Gap That Keeps Me Up at Night
I've been in this industry for over 20 years. I've built my company around doing things the way they should be done, not the way that's cheapest. And this particular gap — the Microsoft 365 backup gap — is one of the most common and most dangerous things I see when I meet with businesses who are unhappy with their current IT provider.
It's not the flashy stuff that gets companies in trouble. It's not ransomware or nation-state hackers. It's the boring, fundamental stuff that nobody thought to check. Like whether anyone is actually backing up the system where all your documents live.
If you want to learn more about the kinds of gaps that exist in most businesses' cybersecurity and IT posture, I write about this stuff regularly. Not to scare you. To arm you with the right questions so you don't end up on the wrong side of a preventable disaster.
Go ask the question. Today. Don't wait until something gets deleted.