Ask a random owner of a 30-person company whether they have an email backup. They'll say yes — they use Microsoft 365. Ask whether they ever tried restoring the mailbox of an employee who left a year ago. That's usually where the conversation ends.
Microsoft 365 is a good service. You get email, OneDrive, SharePoint, Teams, calendars and the Office suite at a reasonable price. One thing is not included in that price: a backup of your data. This isn't a hidden footnote. It's written plainly in Microsoft's documentation as the "shared responsibility model". Microsoft is responsible for making sure the infrastructure runs and is secure. Your data — copies, retention, protection against mistakes and attacks — is your responsibility. These are two different things, even though in most SME owners' heads they merge into one.
What Microsoft actually does
Microsoft 365 has built-in recovery mechanisms, but they're not a backup in the sense understood by anyone who has ever had to restore files from six months ago.
- OneDrive/SharePoint recycle bin: 93 days from deletion. After that, the file is unrecoverable through standard means.
- Email retention: 14 days by default for a deleted mailbox, up to 30 days for individual items in Deleted Items.
- Mailbox after offboarding: once the license is removed, the countdown to deletion starts. You can enable "Litigation Hold", but it's an extra license and a manual decision nobody usually makes.
- File versions: yes, there's version history — but if ransomware encrypts a file 50 times, you get 50 encrypted versions.
These are decent mechanisms. They're designed for typical mistakes — "oops, I deleted the wrong file". They are not designed for the situations that actually hurt.
Where those mechanisms fall short
Four scenarios we see at clients regularly:
1. The employee left 4 months ago. You need their emails about a project that just came back from the drawer. The mailbox was deleted 30 days after offboarding. The emails are gone.
2. Ransomware via OneDrive. An employee clicks an infected attachment. The malware encrypts files on the local disk, OneDrive syncs the changes to the cloud. Version history is there — but for each of several thousand files you have to roll back the version individually or via a script. Doable, but it's two weeks of work for one person.
3. A SharePoint blunder. Someone tries to "tidy up" the folder structure, moves a customer directory, clicks "delete" instead of "move", empties the recycle bin. 93 days pass unnoticed — because nobody opened that folder for a quarter.
4. A malicious departure. An employee knows they'll be let go and, before logging off, deletes files in OneDrive and selected threads in their mailbox. Microsoft's standard retention recovers part of it — but not all.
In each of these scenarios Microsoft's mechanisms can save a fragment of the data. "A fragment" is not the same as "all of it". And that's usually the whole difference.
A concrete example from a Polish SME
A 22-person accounting firm near Poznań. Standard Microsoft 365 Business Standard stack, SharePoint as the document repository for client files. Stable processes, organised team.
What happened: a new employee, in the name of "tidying up" the folder structure, moved and partially deleted one client's directory. They noticed 4 months later, when the client asked for a copy of last year's documentation for the tax office. The SharePoint recycle bin was empty — the 93 days had passed. Versioning didn't help either — the folder had been deleted outright, not overwritten.
What saved them: a year earlier they had rolled out a third-party Microsoft 365 backup tool (Veeam Backup for Microsoft 365, around 4 PLN/user/month — roughly 88 PLN/month for the whole firm). Restoring the folder took 40 minutes.
What it would have looked like without backup: reconstructing the documents from paper originals and customer contact — an estimated 80–120 hours of work plus a real risk to the client relationship (and an accounting firm doesn't have much beyond client relationships). In money terms: 12 years of backup fees paid back in a single incident that happened in the first year of having the backup.
That's the kind of maths that's obvious in hindsight. It's hard to see in advance.
What good Microsoft 365 backup looks like
Four criteria worth imposing on any third-party tool:
- Full scope: email, OneDrive, SharePoint, Teams (chats and files). Not just email — these days most documents live in SharePoint and Teams.
- Long retention: 7 years is the baseline aligned with Polish archiving requirements for most industries. Some (medical, legal) need more.
- Granular restore: a single email, a single file, a single folder. Not just "the whole mailbox" — because in a real incident you need one specific thing, not a full re-import.
- Backup outside Microsoft's infrastructure: data must sit at a different provider. If the problem is in your M365 tenant (compromised admin account, an outage on their side), a backup inside the same infrastructure doesn't save you.
The tools we see most often at Polish SMEs: Veeam Backup for Microsoft 365, Acronis Cyber Protect, Synology Active Backup for Microsoft 365 (if you already run a Synology box), Barracuda Cloud-to-Cloud Backup. Costs are in the 3–6 PLN/user/month range for sensible retention and full scope.
What to do this week
You don't have to pick a tool tomorrow. But this week you can do three things:
- Check your current M365 retention policies. Go into Microsoft Purview (formerly the Compliance Center) and look at what is actually enabled. If it's nothing — that's your starting point, not your finish line.
- Check your offboarding process. What happens to the mailbox and OneDrive of someone who leaves? If the answer is "deleted after 30 days", you have a gap that will hurt one day.
- Make a list of your most important M365 data. Contracts? Accounting records? Project archive? You decide on backup based on what would be hardest to reconstruct — not on what there's most of.
Ten minutes of thinking that will one day turn out to be the best IT time you spent this year.
Microsoft 365 doesn't lose data. The user does. And whether you can get it back is not Microsoft's responsibility — it's yours.