Executive Briefing
Many businesses assume Microsoft handles all their data protection in the cloud. This dangerous misconception leaves organisations vulnerable to data loss from accidental deletion, ransomware, and compliance gaps. Here are five backup myths you need to stop believing.
Why Microsoft 365 Backup Myths Are So Dangerous
Microsoft 365 has become the productivity backbone for over 300 million commercial users worldwide, including the vast majority of Australian SMBs. Because it is a cloud service, many business owners assume their data is automatically backed up, protected, and recoverable at any time. This assumption is not just wrong — it creates a false sense of security that leaves organisations exposed to permanent data loss.
Understanding the distinction between Microsoft's responsibilities and yours is the first step to protecting your business. Let us examine the five most common myths that put your data at risk.
Myth 1: Microsoft Backs Up All Your Data
This is the most widespread and most dangerous myth. Microsoft operates under a Shared Responsibility Model, which clearly delineates what Microsoft protects and what you are responsible for. Microsoft guarantees the availability and uptime of the infrastructure — the physical data centres, the network, and the application layer. Your data, however, is your responsibility.
In practical terms, Microsoft ensures the service stays online and that their hardware does not fail. But if your data is accidentally deleted, maliciously destroyed by an insider, or encrypted by ransomware, Microsoft's infrastructure protection does not help you recover it. Their service-level agreements cover uptime, not data recovery.
"Microsoft services are built with resiliency and redundancy in mind... however, we recommend that customers use a third-party backup solution." — Microsoft Shared Responsibility Model Documentation
Microsoft themselves recommend third-party backup. If the platform provider is telling you their built-in protections are not enough, it is time to listen. Our cloud and Microsoft 365 management team regularly encounters businesses that only discover this gap after a data loss event.
Myth 2: The Recycle Bin Is Your Backup
Many businesses treat the Microsoft 365 Recycle Bin as a safety net. While it does provide a temporary recovery option, it is not a backup solution. Understanding the retention limits is critical:
- SharePoint and OneDrive Recycle Bin: Items are retained for 93 days in the first-stage and second-stage recycle bins combined. After that, they are permanently and irrecoverably deleted.
- Exchange Online Deleted Items: Deleted emails remain in the Deleted Items folder until a user empties it. After that, they move to Recoverable Items for 14 days (or 30 days if configured). Beyond this window, they are gone.
- Teams Chat and Channel Messages: Deleted messages follow Exchange retention policies, but there is no user-facing recycle bin for Teams content. Recovery requires admin intervention within the retention window.
- Mailbox Deletion: When a user licence is removed or an account is deleted, the mailbox enters a 30-day soft-delete window. After that, all email data is permanently lost.
The key problem is that these retention windows are finite. If you discover a data loss event after the retention period has expired — and many businesses do, especially for compliance or legal matters — the data is gone permanently. A proper backup solution retains data for as long as you need it, independent of Microsoft's retention policies.
Myth 3: Microsoft 365 Is Immune to Ransomware
Because Microsoft 365 is a cloud service, some businesses believe it cannot be affected by ransomware. This is dangerously false. Ransomware has evolved to specifically target cloud-connected data.
Here is how it works: OneDrive and SharePoint use file synchronisation to keep local and cloud copies in sync. If a user's device is infected with ransomware that encrypts local files, those encrypted files sync to the cloud, replacing the healthy versions. While OneDrive does offer version history, recovering thousands of files to pre-infection versions is a manual, time-consuming process — and only works if the version history has not exceeded its retention limits.
- Sync-based encryption: Ransomware encrypts local files, which then sync to OneDrive and SharePoint, overwriting clean copies
- Compromised credentials: Attackers who obtain user credentials can access and encrypt or delete cloud data directly through the Microsoft 365 portal
- OAuth app abuse: Malicious third-party apps granted excessive permissions can access and exfiltrate or encrypt data across the tenant
Important Note
The Australian Cyber Security Centre (ACSC) has specifically warned that ransomware targeting cloud services is increasing. Businesses should not rely on cloud storage alone as a defence against ransomware — a separate, immutable backup is essential.
Our cyber security team has seen cases where businesses lost months of work because they assumed their cloud data was safe from ransomware. A dedicated Microsoft 365 backup solution stores copies of your data in a completely separate environment, ensuring you can recover cleanly even after a full-scale ransomware attack.
Myth 4: You Don't Need Backup for Cloud Data
This myth stems from the belief that "cloud" equals "safe." While cloud infrastructure is indeed more resilient than on-premises servers, the data stored in it faces risks that infrastructure redundancy cannot mitigate:
- Accidental deletion: Users delete files, emails, or entire folder structures by mistake. If discovered after retention periods expire, the data is unrecoverable without a backup.
- Malicious insiders: A disgruntled employee or departing staff member can deliberately delete critical data. Without backup, you have no recourse once retention windows close.
- Compliance and legal holds: Australian businesses in regulated industries (finance, healthcare, legal) may need to retain data for 7 years or more. Microsoft's native retention does not meet these requirements without additional licensing and configuration.
- Account deprovisioning: When employees leave, their Microsoft 365 licences are typically reassigned. Without backup, all of that user's email, OneDrive files, and Teams data can be lost after the 30-day soft-delete window.
Research from Veeam's Microsoft 365 Backup Trends report found that 76% of organisations had experienced data loss in their SaaS environment in the previous 12 months. The most common causes were accidental deletion (49%), security threats (34%), and insider threats (17%). These are precisely the scenarios that Microsoft's native protections do not fully address.
Myth 5: Native M365 Tools Are Sufficient for Recovery
Microsoft 365 does offer some data protection tools — Litigation Hold, Retention Policies, and eDiscovery. However, these tools are designed for compliance and legal discovery, not for backup and recovery. Understanding the difference is crucial:
- Litigation Hold: Preserves mailbox data for legal purposes, but it does not create a separate copy. If the mailbox is corrupted, the hold data may be corrupted too. It also requires E3 or E5 licensing.
- Retention Policies: Can retain deleted items beyond default periods, but recovery is not granular. You cannot easily restore a single email from three months ago to a user's inbox.
- Point-in-time restore limitations: OneDrive offers a 30-day file restore feature, but it is all-or-nothing at the library level. You cannot selectively restore individual files to a specific point in time without rolling back everything.
- No cross-service consistency: There is no native way to perform a coordinated restore across Exchange, SharePoint, OneDrive, and Teams to the same point in time.
A proper backup solution provides granular, point-in-time recovery — the ability to restore a single email, a specific document version, or an entire mailbox to any point in your retention history, without affecting other data.
What a Proper Microsoft 365 Backup Solution Looks Like
Now that we have debunked the myths, what should a proper Microsoft 365 backup strategy include? The gold standard follows the 3-2-1 backup rule, adapted for the cloud era:
- 3 copies of your data: The production data in Microsoft 365, plus at least two backup copies
- 2 different storage types: Backups stored on different platforms or media — for example, one in a dedicated backup cloud and one on local infrastructure
- 1 copy offsite or air-gapped: At least one backup copy stored in a separate environment that cannot be accessed or modified by an attacker who compromises your Microsoft 365 tenant
When evaluating Microsoft 365 backup solutions, look for these key features:
- 1Comprehensive coverage: Backup should cover Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams — including Teams chat, channel data, and associated files
- 2Granular recovery: The ability to restore individual items — a single email, a specific file version, or a single Teams conversation — without restoring entire mailboxes or libraries
- 3Automated scheduling: Backups should run automatically at least three times per day, with no manual intervention required
- 4Flexible retention: Configurable retention periods that meet your compliance requirements — from 1 year to unlimited
- 5Australian data residency: For compliance and sovereignty, your backup data should be stored in Australian data centres
Important Note
If your organisation handles health records, financial data, or legal documents, check whether your industry regulations require specific backup retention periods. Australian Privacy Principle 11 requires organisations to take reasonable steps to protect personal information — and that includes having recoverable backups.
How We Researched This Article
This article was compiled using information from authoritative industry sources to ensure accuracy and relevance for Australian businesses.
Sources & References
- →Microsoft Shared Responsibility Model
Official Microsoft documentation outlining the shared responsibility framework for data protection in Microsoft 365
- →Veeam Microsoft 365 Backup Trends Report
Industry research on SaaS data loss frequency, causes, and backup adoption across organisations
- →ACSC Cloud Security Guidance
Australian Government guidance on securing cloud services, including backup and data protection recommendations
- →OAIC Australian Privacy Principles
Australian Privacy Principle 11 — security of personal information, including data backup obligations
* Information is current as of the publication date. Cloud service configurations and security best practices evolve regularly. We recommend verifying current recommendations with the original sources.
Frequently Asked Questions
Most third-party backup solutions run automatic backups between one and three times per day. For businesses with high email volume or frequent document changes, three daily backups provide the best balance between data protection and storage costs. The key is ensuring backups are automated — manual backup processes are unreliable.
Comprehensive backup solutions cover Exchange Online (emails, calendars, contacts), SharePoint Online (sites, libraries, lists), OneDrive for Business (files and folders), and Microsoft Teams (conversations, channel data, associated files). Some solutions also cover additional workloads like Planner, Power BI, and Power Automate.
Third-party Microsoft 365 backup typically costs between $3 and $8 per user per month, depending on the provider, storage requirements, and retention policies. For a 20-person organisation, this works out to $60–$160 per month — a fraction of the cost of a single data loss incident. Many managed IT providers include Microsoft 365 backup as part of their service packages.
While there is no single law mandating Microsoft 365 backup specifically, several Australian regulations require data protection measures that effectively require backup. The Privacy Act 1988 (APP 11) requires reasonable steps to protect personal information. Industry-specific requirements include APRA CPS 234 for financial services, SOCI Act for critical infrastructure, and various health records regulations for healthcare providers. Having a recoverable backup is considered a reasonable step under all of these frameworks.
Without third-party backup, you have a 30-day window to recover a deleted user's mailbox before it is permanently removed. OneDrive data follows a similar 30-day retention for deleted accounts. With a backup solution in place, you can recover a former employee's data at any time within your configured retention period, regardless of when the account was deleted. This is particularly important for businesses with high staff turnover or contractor-based workforces.