Why your Microsoft 365 backup is not Microsoft's job

This is the single most common misunderstanding we run into when we start supporting a new client: the belief that because Microsoft 365 lives "in the cloud," Microsoft is backing it up on your behalf. It isn't, and the small print has said so for years.

What Microsoft actually guarantees

Microsoft's responsibility under the Microsoft 365 shared responsibility model covers infrastructure uptime and platform availability — keeping the service running, keeping the data centres operational, keeping the servers patched. It does not cover you accidentally deleting a SharePoint folder, an employee's mailbox being wiped by ransomware, or a disgruntled leaver purging their OneDrive on the way out.

Microsoft's own native retention tools — the Recycle Bin, version history, litigation hold — are recovery windows, not backups. They're short, limited in scope, and designed to protect Microsoft's platform integrity, not your business continuity.

The gap this creates, concretely

Retention windows expire. Deleted items typically sit in a recoverable state for a matter of weeks, not years. Past that window, they're gone — permanently, and Microsoft support cannot bring them back.

Ransomware doesn't respect version history. If malware syncs encrypted files across SharePoint or OneDrive before anyone notices, your "previous version" may also be compromised, depending on how far back the corruption goes and how long it took to detect.

Deletion is often intentional, not accidental. An employee leaving on bad terms, a compliance dispute, an internal investigation — these are exactly the moments a real backup matters, and exactly the moments native retention is least likely to have what you need.

Emails and mailboxes aren't automatically preserved. A former employee's mailbox, once the licence is removed, can lose data unless specifically retained — a detail that catches out businesses during offboarding far more often than it should.

What a proper Microsoft 365 backup actually does

A dedicated third-party backup solution takes independent, immutable copies of your mail, SharePoint, OneDrive and Teams data on a schedule you control, stored separately from your live Microsoft 365 tenant. That separation is the entire point — if your tenant is compromised, encrypted, or has data deleted (by accident or on purpose), the backup isn't affected, because it isn't living in the same place.

Look for:

Point-in-time recovery — restoring a mailbox or file library to exactly how it looked on a specific date, not just "the last known version"

Retention that matches your compliance obligations, not Microsoft's default windows

Granular restore — recovering one email or one file without restoring an entire mailbox over the top of the current one

Immutability — backups that can't be altered or deleted by anyone with access to the live tenant, including a compromised admin account

Why this matters more in Malta specifically

Smaller local businesses are disproportionately likely to run lean IT — often without a dedicated in-house administrator watching retention policies or offboarding checklists. That's exactly the profile most exposed to this gap, and it's a conversation we have with new clients on a near-weekly basis. It's rarely negligence. It's a reasonable assumption that turns out to be wrong.

Frequently asked questions

Doesn't Microsoft 365 already have "backup" features built in?

It has retention and recovery features — version history, the Recycle Bin, litigation hold — which are genuinely useful but time-limited and designed around platform integrity, not business continuity. They're not a substitute for an independent backup.

How much does third-party M365 backup typically cost?

It's usually priced per user, per month, and is a modest addition to your existing licence cost relative to the exposure it closes — small enough that the conversation is rarely about price once the gap is understood.

Does this apply to Teams and SharePoint, or just email?

All of it. Teams messages, channels and files, SharePoint document libraries, and OneDrive are all subject to the same retention limitations as mailboxes.

We're a five-person business — do we really need this?

Size doesn't change the exposure, only the visibility of the risk. A five-person business losing a year of client correspondence is arguably more damaging than a fifty-person business absorbing the same loss.

---

eMerge provides managed IT services and cloud backup solutions for SMEs across Malta, including independent, immutable backup for Microsoft 365. Get in touch if you're not sure what your current retention actually covers — it's a five-minute check worth having.