Most businesses assume that because their email and files live in Microsoft 365, Microsoft is backing them up. Microsoft’s own service agreement says otherwise.
Not sure what would actually happen if a mailbox or SharePoint folder got wiped out tomorrow? Contact us for a free assessment — no pressure, no obligation.
What Microsoft 365 Actually Protects Against
Microsoft’s responsibility is keeping the infrastructure running — the datacenters, the servers, the uptime of the service itself. If a Microsoft datacenter has a hardware failure, that’s on Microsoft, and it’s extremely well protected against. What Microsoft does not take responsibility for is the data your business puts into that infrastructure. That’s explicitly called out as the customer’s responsibility under Microsoft’s shared responsibility model.
What It Doesn’t Protect Against
- Accidental deletion past the retention window — deleted items folders and recycle bins have limits, typically measured in days, not years.
- Ransomware that encrypts synced files — if a workstation gets hit and files sync to OneDrive or SharePoint, the encrypted versions can overwrite the good ones.
- A malicious or compromised account purging a mailbox — whether it’s an angry departing employee or an attacker who gained access, mass-deletion happens fast and isn’t automatically reversible.
- Malicious inbox rules — a compromised account quietly auto-deleting or auto-forwarding incoming mail, often for weeks before anyone notices.
What Real Cloud Backup Looks Like
Independent, third-party backup for Microsoft 365 (and Google Workspace) copies your mail, OneDrive, SharePoint, and Teams data into separate, versioned storage — outside of Microsoft’s own infrastructure. That means you can restore a single deleted email from eight months ago, or roll a whole mailbox back to before a ransomware event, regardless of what Microsoft’s own retention settings allow.
Can You Do This Yourself?
Yes — third-party tools like Veeam or Datto built specifically for Microsoft 365 and Google Workspace backup are available directly to businesses. The gap is usually setup and follow-through: someone has to configure retention policies correctly, monitor that the backup jobs are actually completing, and periodically confirm a restore actually works.
The Bottom Line
Cloud backup for the Microsoft 365 and Google Workspace data that Microsoft and Google don’t fully protect on their own is a core part of every LME Services backup and disaster recovery plan. Schedule a free consultation and we’ll show you exactly what’s covered — and what isn’t — in your current setup.
Common questions
Microsoft's responsibility is keeping the infrastructure running — the datacenters and uptime — not the data your business puts into that infrastructure, which is explicitly the customer's responsibility under Microsoft's shared responsibility model.
Without a separate backup, recovery options are limited, since Microsoft's own retention windows aren't a substitute for a real backup.