Does Microsoft 365 Back Up Your Data? Common Myths About Backup

Microsoft 365 does not back up your data on your behalf. Microsoft is responsible for keeping the infrastructure running, while protecting the data is the customer organisation's responsibility. A deleted email, files encrypted by ransomware or folders deleted by a departing employee fall outside Microsoft's responsibility. In this article we look at common misconceptions about backup and at the essentials of a backup strategy that can withstand ransomware.

What does the Microsoft agreement say?

In its services agreement, Microsoft recommends that users regularly back up their content and data. In cloud services this approach is called the shared responsibility model:

• The provider's responsibility: data centres, hardware, network and keeping the service running.
• The organisation's responsibility: the data itself, access management, account security and backup.

Most IT managers either do not know this, or know it and dismiss it with "nothing will happen to us".

When Microsoft does not protect you

• Emails a user deleted by mistake whose retention period has expired
• Files encrypted by ransomware and carried to the cloud by synchronisation
• Data deliberately deleted by a departing employee
• Bulk deletions made through a compromised account

In each of these cases, getting the data back depends on the organisation's own backup.

The cost of backup and the cost of having none

According to IBM's 2024 report, the average cost of a data breach is $4.88 million. An organisation without a backup strategy has accepted this risk, knowingly or not.

One of the most painful examples is the story of KNP Logistics, a 158-year-old logistics company in the UK. Attackers got in through an employee's guessable password, and ransomware encrypted critical data. The company had cyber insurance but could not recover its data. In the end it closed and around 700 people lost their jobs. The lesson is clear: insurance alone is not enough, and a backup of critical data is vital.

Cold backup: the key to not losing everything

Cyber attackers only need to succeed once. Defence teams have to make the right move every day. That is why one of the most critical defences is cold backup, meaning offline, isolated backup.

In modern ransomware attacks, attackers first find and delete the backups, then encrypt the data. A backup that is always connected to the network is a backup the attacker can reach. A properly configured cold backup lets the company recover quickly after an attack.

Security needs more than one wall

Firewalls, endpoint protection and MFA are a good start. But what happens if something fails? Resilience begins where prevention ends. That requires a backup plan and a clear recovery strategy.

The elements of an effective backup strategy

1. The 3-2-1 rule: at least three copies of the data, on two different media, with one copy in a different location.
2. An isolated copy: at least one copy should be disconnected from the network or immutable.
3. Cover cloud data: use a separate backup solution for data in Microsoft 365, Google Workspace and other SaaS applications.
4. Regular testing: a backup you cannot restore is no backup at all. Test the recovery plan at regular intervals.
5. Limit access: only a few people should have access to the backup system, and it should be protected with MFA.

Frequently asked questions

---
InfoLore's awareness programmes also cover common misconceptions about backup and data responsibility. Get in touch to measure how much your employees know about this.