'It's in the cloud, so Microsoft backs it up' is one of the most expensive misunderstandings in UK business IT. It feels obviously true - your email, files and Teams chats live in Microsoft's data centres, so surely they are safe? They are safe from Microsoft's hardware failing. They are not safe from you, your staff, or an attacker - and the gap between those two things is exactly where firms lose data they thought was protected. Let us bust the myth properly.
The myth, stated plainly
The belief goes like this: Microsoft 365 is a cloud service run by one of the largest technology companies on earth, with vast, resilient infrastructure - so backup is obviously baked in and not something a customer needs to think about. Half of that is true, which is exactly what makes it dangerous.
Microsoft does keep your service running with extraordinary reliability, and it does protect your data against its own data centres failing. What it does not do is take responsibility for recovering data you lose through your own actions. That distinction has a name, and once you know it the whole picture changes.
The shared responsibility model
Cloud services run on what is called the shared responsibility model, and Microsoft states it openly. In short: Microsoft is responsible for the availability of the platform - keeping the lights on, the service up, the infrastructure resilient. You are responsible for your data within it.
Read that again, because it is the crux. Microsoft keeps the service available; protecting and recovering your actual content is your job. Their job is uptime. Your job is your data. The platform staying up is not the same as your data being recoverable - and assuming otherwise is precisely the error that costs businesses dearly.
What actually goes wrong (and Microsoft will not save you)
Once you accept that data protection is yours, the real risks come sharply into focus. None of these are exotic - they are the everyday ways businesses lose Microsoft 365 data, and in each case Microsoft is working exactly as designed.
- •Accidental deletion: a staff member deletes an important email, file or whole folder - and notices months later, long after any short retention window has passed.
- •Departing staff: an employee leaves, their account is removed to save a licence, and their mailbox and OneDrive vanish with it.
- •Ransomware and malware: malicious files sync into SharePoint and OneDrive, encrypting or corrupting your data across the service.
- •Malicious insiders: someone with access deliberately deletes or sabotages data on the way out.
- •Retention gaps: Microsoft's built-in recycle bins and retention are short-term safety nets, not a long-term backup, and they can be misconfigured or expire.
Built-in retention is not a backup
Microsoft 365 does include recycle bins, retention policies and litigation hold, and people point to these as proof a backup exists. They are useful, but they are not a backup in any meaningful sense - and leaning on them is how the myth survives.
The problems are concrete: retention windows are limited and expire; recycle bins can be emptied, by a user or an attacker; the controls are complex and easily misconfigured; and none of it gives you the quick, reliable, point-in-time restore of a real backup. It is the same lesson as RAID is not a backup - resilience and retention are not the same as the ability to recover. A proper backup is independent, immutable where possible, and squarely under your control.
What to actually do
The fix is a dedicated third-party backup for Microsoft 365 - a separate service that takes its own regular, independent copies of your email, OneDrive, SharePoint and Teams, retains them as long as you choose, and lets you restore quickly when something goes wrong. It is inexpensive, runs in the background, and turns a potential catastrophe into a minor inconvenience.
This is simply the cloud version of how to back up business data, applying the 3-2-1 backup rule to your cloud just as you would to a server - ideally with immutable copies ransomware cannot touch. For the buyer-level detail, our best backup software guide and immutable backup architectures go deeper, and our backup and disaster recovery service can set it up so you never have to test the myth the hard way. If you are not sure what your plan even covers, our Microsoft 365 plans explainer and SharePoint guide will help.