Is Microsoft 365 backed up? What you need to know

Many businesses believe their Microsoft 365 e-mail and files are backed up by Microsoft. That is only partly true: Microsoft guarantees that the service runs and that the data is replicated, not that you will be able to recover an item deleted six months ago.

The shared responsibility model

Microsoft is responsible for the infrastructure, the availability of the service and the replication of data between its data centers. You remain responsible for your data: anything deleted, overwritten or encrypted by mistake or with malicious intent is also deleted, overwritten or encrypted in the replicated copies.

What Microsoft 365 already offers

The recycle bins keep deleted items for a limited time, from a few weeks to about three months depending on the service. Version history lets you go back to an earlier version of a file. Retention policies can be configured. These features are useful, but they stay on the same platform, with limited retention periods and restores that can be laborious.

Situations where it is not enough

• A deletion discovered after the recycle bins have expired.
• A compromised account that deletes or encrypts files, which are then synchronized everywhere.
• The account of an employee who has left, deleted along with its content.
• An administrative error that affects many items at once.
• The need to recover the exact state of a folder on a given date.

What a Microsoft 365 backup should cover

• Exchange: e-mail, calendars and contacts, including shared mailboxes.
• OneDrive and SharePoint, with their versions.
• Teams, whose files are stored in SharePoint.
• At least a daily frequency, and a retention period defined with you.
• Item-level restore, without restoring the whole mailbox.
• Storage outside Microsoft, in a known location.

Our approach

When this service is subscribed, we back up Microsoft 365 independently of the platform, with storage in Switzerland spread across three ISO 27001 certified sites in Geneva, Gland and Lucerne. Retention is set in the contract, and periodic restore tests can be included in it.