"It's in the cloud, so it's backed up." We hear that sentence in almost every assessment we do for a South Shore business that has moved to Microsoft 365, and it is the most expensive misunderstanding in small-business IT. Microsoft keeps the service running. Microsoft does not promise to get back the folder your bookkeeper deleted in March, the mailbox of the salesperson who left in June, or the SharePoint library that ransomware encrypted through a synced laptop on a Friday night.
This post explains the difference between service availability and data backup, the five specific gaps we see businesses fall through, and what an independent Microsoft 365 backup actually consists of. The same points apply to Google Workspace.
Availability is not backup
Microsoft operates Microsoft 365 under what it calls a shared responsibility model, and it publishes that model. The short version: Microsoft is responsible for the infrastructure and for keeping the service up; you are responsible for your data, your users, and your access controls. Microsoft's own terms of service recommend that customers regularly back up the content they store in the service, using Microsoft tools or third-party services.
That division makes sense from Microsoft's side. Exchange Online, SharePoint, OneDrive, and Teams are replicated across data centers so that a hardware failure in one place does not take your email down. Replication is about uptime. It copies whatever is in your tenant, including deletions and encrypted files, to every other copy within moments. A replicated deletion is still a deletion.
Microsoft does provide recycle bins, deleted-item recovery, version history, and retention policies, and those features matter. But each one has a window, each window is measured in days or months rather than years, each one depends on your licensing and on settings someone has to configure, and all of them live inside the same tenant that an attacker with an admin password controls. They are safety nets for small mistakes caught quickly. They are not a backup.
The five gaps we see most on the South Shore
1. The deletion nobody noticed in time
An employee cleans up a shared drive and deletes a client folder. Nobody needs the folder until an audit, a lawsuit, or a warranty claim eight months later. By then it has aged out of the recycle bin and the second-stage recycle bin, and there is no copy anywhere. This is the single most common restore request we get, and the only businesses that can satisfy it are the ones whose backup retention is set by them, not by the platform.
2. The departed user's mailbox and OneDrive
When someone leaves, the natural move is to remove their license to stop paying for it. Removing the license starts a clock on the mailbox and the OneDrive. Keep the account and you pay for a seat nobody uses; delete it and the data is eventually purged. Businesses that have not thought about this discover it when a former employee's email is subpoenaed, or when the only copy of a contract was in a OneDrive that no longer exists. Our offboarding process for managed clients preserves the mailbox and files on the same day access is revoked, and an independent backup is what makes that cheap to keep for years.
3. Ransomware that arrives through OneDrive sync
OneDrive and SharePoint sync are excellent at doing exactly what they are told. If ransomware encrypts files on a laptop, the sync client faithfully uploads the encrypted versions, and the platform's replication spreads them. Version history can sometimes roll files back, but only within its window, only file by file or library by library, and only if the attacker did not also have the credentials to turn retention off or delete the versions. The attacks that hurt small businesses are the ones where an administrator account was phished first. An immutable copy stored outside the tenant, one that cannot be changed or deleted for a defined period even by an administrator, is the control that makes that scenario survivable.
4. The Teams conversation that was the only record
Teams chats, channel posts, and the files attached to them are where a lot of small-business decisions now live, and they are the workload people most often assume is "just there." Retention for Teams depends on policy settings that, in most tenants, were made by whoever signed up first and never revisited. A backup that covers mail and files but not Teams has a hole in it.
5. The retention policy that was never set, or was set by someone who left
Microsoft 365 can be configured to hold data for a long time, and regulated businesses often need that. But a retention policy is a setting, not a copy. It can be changed by any global administrator, it does nothing for data deleted before it was applied, and it does not restore a working mailbox or library to a point in time. We regularly inherit tenants where the only person who understood the retention setup has left and nobody can say what is actually being held.
What an independent backup looks like
The design we use for Microsoft 365 is the same one practitioners use for any data: multiple copies, on different media, with at least one off-site and at least one that cannot be altered. For a cloud tenant, that means:
- Tenant backup to independent storage. Mailboxes, OneDrive and SharePoint, Teams, and contacts and calendars are backed up on a schedule to storage that Microsoft does not operate and that your tenant's admin credentials cannot reach. The retention window is set by your business and compliance needs, not by the platform.
- An immutable, ransomware-resistant copy. At least one copy that cannot be changed or deleted for a defined period, even by an administrator account.
- Granular recovery. Restore a single file, a folder, a mailbox, a specific version, or a whole site from any point in the retention window, without rebuilding everything else.
- Laptop backup for work in progress. For a remote-first office with no server, the laptops hold work that has not synced yet. We back those up too.
- Monitoring and verification. Every backup job is monitored and failures are alerted to us and fixed. A job that reports "completed" is not the same as a backup that restores.
- Scheduled restore tests. We restore real mailboxes and real files on a schedule, record how long it took, and send you the results. A backup that has never been restored is untested, and we do not let clients run on untested backups.
- A written recovery plan. A plain-language document listing what is protected, where the copies are, who does what, and the expected recovery time for each system. It doubles as the business-continuity document that cyber-insurance applications and customer contracts ask for.
If you are already a managed IT client, backup monitoring and restore testing are part of your plan. If you have IT support from someone else and only need the backup side handled properly, we do that on its own.
Where compliance comes in
For most South Shore businesses this is a practical question, not a legal one, but two rules are worth knowing. The HIPAA Security Rule's contingency plan standard requires covered entities and business associates to be able to retrieve exact copies of electronic protected health information, which for a dental or medical practice living in Microsoft 365 means a backup of the tenant, not just a subscription. Massachusetts 201 CMR 17.00 requires a written information security program with reasonable safeguards for personal information, and demonstrating that you can recover records after an incident is part of a program an auditor will take seriously. Our IT compliance pages cover both frameworks; this is general information, not legal advice.
How to find out where you stand
You do not need to take our word for any of this. Three questions will tell you whether your business has a gap:
- Pick a file someone deleted a year ago. Can anyone produce it today? If the answer involves hoping it is still in a recycle bin, you have gap one.
- Name the last employee who left. Where is their mailbox, and who could restore an email from it this afternoon?
- Ask who could delete the backup. If the honest answer is "anyone with the Microsoft 365 admin password," the backup and the data share the same single point of failure.
We check all three during the free assessment we run for businesses in Plymouth, Kingston, Duxbury, Marshfield, Pembroke, Hanover, and the rest of the South Shore, along with whatever backups exist today and how they would survive ransomware or a site loss. You get the findings in plain English whether or not you hire us. Pricing is per server, per workstation, or per Microsoft 365 user plus storage, as explained on the backup page and in our post on what managed IT costs on the South Shore.
Frequently asked questions
Does Microsoft really not back up my data? Microsoft replicates your data for availability and offers recycle bins, version history, and retention features with limited windows. It does not provide a point-in-time backup you control with retention you set, and its terms recommend that you back up your own content. That is the gap an independent backup fills.
We use Google Workspace. Does this apply to us? Yes. Gmail, Google Drive, shared drives, and calendars have the same availability-versus-backup distinction, and we back them up the same way.
Is a backup still needed if we have a retention policy? A retention policy is a setting inside the tenant. It helps with legal holds and long-term retention but does not restore a working mailbox or library to a point in time, cannot protect data deleted before it was applied, and can be changed by a global administrator. Backup and retention are complementary, not interchangeable.
How much data do we lose if something happens? That depends on how often the backup runs, which is set by how much work you can afford to redo. Most tenants are backed up several times a day. The written recovery plan states the number for each system so there are no surprises.
Does backup replace our cloud services setup or migration? No. Moving email and files into Microsoft 365, cleaning up a tenant, and managing licenses is our cloud services work. Backup protects the data once it lives there. Most clients need both, and they are handled by the same team.
If any of the three questions above gave you pause, book a free assessment or call (508) 617-1310. We will tell you exactly what is and is not protected today.
Written by Chris Kolacz, founder of Power Up Boston. Chris has set up and restored backups for South Shore businesses from the company's Plymouth office since 2009.