Introduction
If someone asked you right now whether your Microsoft 365 data — your emails, SharePoint files, Teams conversations, OneDrive documents — is backed up, what would you say?
Most business owners say yes. Microsoft is a world-class technology company with sophisticated infrastructure, so of course the data is protected. It’s a reasonable assumption. It’s also wrong — and it’s one of the most consequential misconceptions we encounter when working with Melbourne businesses.
What Microsoft Actually Protects — And What It Doesn't
Microsoft operates on a Shared Responsibility Model. Under this model, Microsoft is responsible for the availability and reliability of the platform — ensuring the service is running, secure at the infrastructure level, and performing correctly. What Microsoft is not responsible for is the protection and recovery of your business data. That responsibility sits with you.
From Microsoft’s own service documentation: ‘Microsoft 365 includes a number of tools to assist customers in recovering data in some scenarios, but these features are not intended to be a substitute for a backup solution.’
What Microsoft does provide — and it’s useful to understand the limits — includes Recycle Bin retention (deleted items kept for a period before permanent deletion), file version history in SharePoint and OneDrive, and Litigation Hold for compliance purposes. None of these are a backup. They are retention features with time limits and significant gaps.
Real Scenarios Where Microsoft's Built-In Protection Fails
Accidental or Deliberate Deletion
Real-Life Scenario: The Folder That Disappeared Before Anyone Noticed
A 50-person financial advisory firm in Melbourne used SharePoint as their central document repository. A junior administrator, while reorganising a folder structure, accidentally deleted an entire project folder containing three years of client compliance documentation. She assumed it had gone to the Recycle Bin. The deletion was noticed four months later when a senior adviser went to retrieve documents for a client review. The Recycle Bin retention period had expired. The folder and all its contents — including documents that would have taken weeks to reconstruct — were permanently deleted from Microsoft’s platform. The firm had no third-party Microsoft 365 backup. Document recovery was attempted through Microsoft support and confirmed as unrecoverable. The team spent over three weeks partially reconstructing documents from email attachments, client copies, and memory. Several documents could not be recovered at all.Ransomware Attacks Targeting Cloud Data
Real-Life Scenario: When Ransomware Followed the Files to the Cloud
A Melbourne professional services firm with 35 staff used OneDrive to sync all staff documents. When ransomware infected a staff member’s laptop, it began encrypting files locally — and because OneDrive sync was active, those encrypted files were immediately synchronised to the cloud, overwriting the clean versions. Version history in OneDrive retained previous versions, but the ransomware had been encrypting files gradually over several days before detection. By the time the attack was identified, the version history for many files only contained encrypted versions — the clean versions had aged out of the retention window. Recovery required painstaking file-by-file restoration across multiple version histories, and a significant volume of recently modified documents was unrecoverable. A dedicated Microsoft 365 backup solution with point-in-time restore to before the attack began would have allowed complete, rapid recovery of the entire environment.Employee Departure and Account Deletion
Real-Life Scenario: The Sales Director’s Files That Vanished With Her Licence
A 40-person technology distributor in Melbourne’s east had a sales director resign after five years. The business cancelled her Microsoft 365 licence promptly — standard offboarding procedure. What they didn’t know was that cancelling the licence started a 30-day clock on her OneDrive data. Seven weeks after her departure, her replacement went to retrieve a specific client proposal that only existed in the former sales director’s OneDrive. The data had been permanently deleted by Microsoft after the 30-day retention period expired. The proposal — which had been the basis for a significant pending contract renewal — could not be recovered. A Microsoft 365 backup solution retains user data independently of licence status, giving businesses the ability to recover content from departed employees regardless of when the licence was removed.Compliance and Regulatory Retention Requirements
Many industries have regulatory requirements for data retention that extend well beyond Microsoft’s default retention periods. Healthcare, financial services, legal, and accounting firms may be required to retain records for 7 years or more. Microsoft’s built-in retention tools require careful configuration to meet these requirements — and even then, they are not designed to function as an auditable backup record. A third-party backup solution provides the long-term, independently maintained retention that regulated industries require.
What a Proper Microsoft 365 Backup Solution Provides
A dedicated Microsoft 365 backup solution provides what the name suggests: a genuine, independently maintained backup of your Microsoft 365 data — covering Exchange Online, SharePoint, OneDrive, and Microsoft Teams — that can be restored on demand with granular control.
Key capabilities that Microsoft’s built-in tools do not provide:
- Point-in-time restore — recovering data to a specific moment before deletion or corruption
- Granular recovery — restoring a single email, a specific file, a folder, or an entire mailbox
- Long-term retention extending well beyond Microsoft’s default limits
- Ransomware protection — backup data stored in an environment isolated from your Microsoft 365 tenant
- Compliance support — meeting regulatory retention requirements with documented, auditable backup records
- Departed employee data retention — preserving user data independently of licence status
Five Questions Worth Answering Honestly
- If a staff member permanently deleted an important folder six months ago, could you recover it today?
- If ransomware encrypted your SharePoint content last week, how far back could you restore a clean version?
- Do you know what happens to a former employee’s OneDrive data after their account is removed?
- Can you meet your industry’s data retention requirements using only Microsoft’s built-in tools?
- Has anyone in your organisation actually tested a Microsoft 365 restore — not just assumed it would work?
If any of these made you uncomfortable, that’s the right signal. A proper Microsoft 365 backup solution is not expensive relative to the risk it addresses — and implementation is typically straightforward.
What BrainTech IT Recommends
We implement dedicated Microsoft 365 backup solutions for Melbourne businesses across all sizes, and include Microsoft 365 backup as a standard component of our Backup and Disaster Recovery service. The right solution depends on your data volume, compliance requirements, and recovery objectives — but the principle is consistent: Microsoft 365 data needs an independently managed backup, not just reliance on Microsoft’s built-in retention features.
The businesses in the scenarios above all had one thing in common: they assumed they were protected. Assumptions don’t survive ransomware attacks, accidental deletions, or regulatory audits. A backup does.
Not sure if your Microsoft 365 data is properly protected? Contact BrainTech IT for a free backup assessment.