Millions of businesses rely on Microsoft 365 for their email, file storage and daily collaboration. Exchange Online, OneDrive, SharePoint and Teams have become the operational core of organisations of all sizes. However, most of these businesses assume that Microsoft takes care of protecting all their data, and that assumption is dangerously wrong.
Microsoft operates under a shared responsibility model: they guarantee the availability of the infrastructure and the platform, but protecting the data you store within it is your responsibility. This model is officially documented in the Microsoft Azure shared responsibility guide and applies equally to all Microsoft 365 services. Understanding this distinction is the first step towards protecting your organisation.
What Microsoft Protects and What It Does Not
Microsoft invests billions annually in the security of its data centres. Its infrastructure provides geographic replication, hardware failure protection, network redundancy and defence against DDoS attacks. These measures ensure that the Microsoft 365 service remains available and functional. However, these protections do not cover what happens to your data within that service.
Native Microsoft 365 retention has significant limitations. Items deleted from Exchange Online are kept in the recoverable items folder for a maximum of 14 days (extendable to 30 days with additional configuration). In OneDrive and SharePoint, the second-stage recycle bin retains files for 93 days from the original deletion. Once that period has elapsed, the data is permanently gone and Microsoft cannot recover it.
Microsoft's responsibility vs your responsibility:
- Microsoft: Infrastructure availability, geographic replication, physical security, OS and platform patching.
- Your business: Data protection, long-term retention, recovery from accidental or malicious deletion, regulatory compliance and access management.
Data Loss Scenarios in Microsoft 365
Data loss in Microsoft 365 is not a theoretical risk: it happens every day in businesses of all sizes. These are the most common scenarios that a dedicated backup solution can address:
- warning Accidental deletion: a user deletes an email, a file or an entire SharePoint folder without realising. If the error is discovered after the native retention window (14-93 days), recovery is impossible without an external backup.
- warning Disgruntled employee: a departing employee may deliberately delete emails, contacts, calendars and OneDrive files before leaving. The account is deactivated, but the damage is already done.
- warning Synchronised ransomware: a ransomware attack encrypts local files and OneDrive automatically syncs the encrypted files to the cloud, replacing the clean versions. Version history can help, but it has limitations and is not a real backup solution.
- warning Tenant-to-tenant migration: during mergers, acquisitions or restructuring, migrating data between Microsoft 365 tenants can cause data loss if not executed correctly. A pre-migration backup is the only guarantee of recovery.
- warning Licence expiry or account cancellation: when a Microsoft 365 licence is removed or a subscription is cancelled, Microsoft purges the associated data after a brief grace period. Without backup, that data is permanently lost.
Risks and Coverage: Native Microsoft vs Dedicated Backup
The following table compares the coverage that Microsoft offers natively versus a dedicated backup solution such as Veeam for Microsoft 365:
| Risk | Native Microsoft 365 | Dedicated Backup (Veeam) |
|---|---|---|
| Accidental deletion | Recycle bin 14-93 days | Unlimited retention, granular restore |
| Malicious deletion | No protection if recycle bin is emptied | Independent, immutable copies |
| Synchronised ransomware | Limited versioning in OneDrive | Full point-in-time restore |
| Tenant-to-tenant migration | No native functionality | Full pre-migration backup |
| Licence expiry | Data purged after grace period | Data accessible independently |
| Legal hold / GDPR | Litigation Hold (requires E3/E5) | Customisable unlimited retention |
| Granular restore | Limited to recent items | Any item, any date |
What a Complete Microsoft 365 Backup Includes
A professional backup solution for Microsoft 365, such as the one we offer at EasyDataHost with Veeam Backup for Microsoft 365, protects all critical platform services with full granularity:
- check_circle Exchange Online: emails, calendars, contacts, tasks, notes and attachments. Granular restore of individual items or entire mailboxes to any point in time.
- check_circle OneDrive for Business: all files, folders and permission structures. Ability to restore specific file versions or complete folder structures.
- check_circle SharePoint Online: sites, document libraries, lists, metadata and permissions. Restore at the site, library or individual item level.
- check_circle Microsoft Teams: channel conversations, shared files, team settings and tabs. Teams data is stored in SharePoint and Exchange, so a complete backup covers the entire ecosystem.
- check_circle Unlimited retention: unlike native Microsoft retention, a dedicated backup retains data for as long as you need, without artificial 14 or 93-day limits.
Legal Requirements and Regulatory Compliance
Beyond operational protection, there are legal requirements that make having an independent Microsoft 365 backup essential. The General Data Protection Regulation (GDPR) establishes clear obligations that directly affect data management on cloud platforms:
- check_circle GDPR Article 17 (Right to erasure): you must be able to delete specific personal data when a data subject requests it. This requires the ability to locate and delete data granularly within backups, something that native Microsoft retention does not facilitate.
- check_circle GDPR Article 32 (Security of processing): requires implementing technical measures to ensure the ability to restore the availability and access to personal data in the event of an incident. An independent backup is the most direct measure to fulfil this requirement.
- check_circle Legal hold and eDiscovery: in regulated sectors (financial, healthcare, legal), businesses must retain communications and documents for specific periods for audits and legal proceedings. A backup with configurable retention ensures compliance without relying on premium Microsoft licences.
- check_circle Compliance audits: external auditors require evidence that data can be recovered at any time. An independent backup with activity logs provides the traceability that audits demand.
How Veeam Backup for Microsoft 365 Works
Veeam Backup for Microsoft 365 is the market-leading solution for protecting M365 data. At EasyDataHost we deploy and manage this solution with storage in our data centre in Spain, which guarantees data sovereignty and GDPR compliance.
The Veeam architecture for M365 works as follows:
M365 backup architecture with Veeam:
- API connection: Veeam connects to the Microsoft 365 tenant via official Microsoft Graph and EWS APIs, with no agents or platform modifications required.
- Incremental backup: after the initial full backup, only changes are transferred (new emails, modified files), minimising bandwidth consumption and execution time.
- Storage at EasyDataHost: backup data is stored in Object Storage S3 in our data centre in Spain, encrypted with AES-256 and with optional immutability via Object Lock.
- Configurable frequency: backups can be scheduled at frequencies from every 5 minutes to once daily, depending on each organisation's RPO requirements.
- Granular restore: Veeam Explorer allows you to restore an individual email, a specific OneDrive file, an entire SharePoint site or a complete Teams team, directly to the original tenant or to a different one.
For organisations that also need to protect their on-premise infrastructure, the M365 backup solution integrates seamlessly with Veeam Cloud Connect Offsite, providing a unified protection strategy for hybrid environments.
Checklist: Do You Need Microsoft 365 Backup?
If you answer yes to any of these questions, your organisation needs an independent backup solution for Microsoft 365:
- check_circle Does your business manage critical data in Exchange, OneDrive or SharePoint whose loss would have significant operational or financial impact?
- check_circle Are you subject to regulations requiring data retention beyond the 93 days that Microsoft offers natively (GDPR, financial sector, healthcare)?
- check_circle Do you have employees with access to sensitive data who could delete information accidentally or intentionally?
- check_circle Do you need to restore Microsoft 365 data with granularity (an email, a file, a site) without relying on Microsoft support?
- check_circle Could your organisation be affected by ransomware that propagates through OneDrive sync or Exchange attachments?
Conclusion
The question is not whether you need Microsoft 365 backup, but when you are going to implement it. Microsoft's shared responsibility model makes it clear that protecting your corporate data is your responsibility. The platform's native retention is a convenience mechanism, not a backup strategy.
Data loss scenarios are real and frequent: accidental deletion, departing employees, synchronised ransomware, tenant-to-tenant migrations and licence cancellations. Any of these can cause permanent loss of critical data if you do not have an independent backup solution.
- arrow_right Microsoft protects the infrastructure, but your data is your responsibility under the shared responsibility model.
- arrow_right Native retention of 14-93 days is insufficient for most business and regulatory requirements.
- arrow_right Veeam Backup for Microsoft 365 provides complete protection for Exchange, OneDrive, SharePoint and Teams with granular restore.
- arrow_right Storing backups at EasyDataHost guarantees data sovereignty in Spain and GDPR compliance with AES-256 encryption and immutability.