Microsoft 365 Without Backup: The Mistake That Can Cost You Everything

Microsoft 365 has become the operational backbone for most organisations: email, documents, Teams collaboration, business processes built on SharePoint. Precisely because it works reliably and rarely goes down, a dangerous assumption takes hold — that the data is automatically protected and recoverable in any scenario. In reality, Microsoft guarantees the availability of the service, not the integrity of your content.

The difference becomes painfully clear the day a user deletes a SharePoint library, a compromised account empties mailboxes, or an employee leaves and their licence is removed. That is when the question arises: where do we restore from?

The shared responsibility model

Microsoft operates on a publicly documented shared responsibility model. In simple terms:

Microsoft is responsible for:

• the physical data centre infrastructure;
• platform availability and redundancy;
• service-level security and software updates;
• replicating data across data centres to survive hardware failure.

You are responsible for:

• the data itself and who has access to it;
• correct configuration of security and retention policies;
• identity and permission management;
• recovering data lost for reasons unrelated to the platform.

Replication is not backup. If a file is deleted or encrypted by an attacker, the replicated copy in another data centre is deleted or encrypted too. Replication protects against hardware failure — not against human error or malicious activity.

What native tools do not cover

Microsoft 365 includes genuinely useful mechanisms: the recycle bin, Recoverable Items, versioning in SharePoint and OneDrive, retention policies in Purview. They have value, but also limits you should understand before an incident rather than after.

Time-limited retention

Deleted items remain available for a defined period, then are permanently purged. Many data losses are not noticed immediately: a project folder archived by mistake may be discovered missing months later, long after the recovery window has closed.

Mailbox removal when a licence is released

When a licence is removed, the associated mailbox enters a limited grace period and then disappears. For organisations that must retain former employees' correspondence for legal or contractual reasons, this default behaviour is a genuine problem.

Granular recovery is hard

Native tooling was not designed for bulk restores. Recovering thousands of emails into an identical folder structure, rolling a SharePoint site back to its state three weeks ago, or selectively restoring conversations and files from a Teams channel are laborious operations — sometimes impossible.

Retention is not inherently immutable

An administrator with compromised privileges can change policies, disable protections and delete content. Without an independent copy held outside the tenant's control, there is nothing to fall back on.

The scenarios that cause most losses

• Accidental deletion. The most mundane and the most common cause. A user moves or removes content without grasping the consequences.
• Synchronised ransomware. Files encrypted locally and synced through OneDrive or the SharePoint client propagate to the cloud as legitimate changes.
• Account compromise. Attackers who gain access create forwarding rules, delete evidence and empty folders to cover their tracks.
• Employee departure. Whether through deliberate action or licence deactivation, account data can vanish.
• Migration or configuration errors. Policy changes applied at scale can remove content in bulk.
• Audit requirements. Not data loss as such, but the need to produce years-old correspondence creates the same difficulty.

What a sound strategy looks like

The 3-2-1 principle still applies in the cloud: three copies of your data, on two different media types, with one held elsewhere. Applied to Microsoft 365, it means your tenant data needs at least one independent copy stored separately.

In practice, a mature solution should deliver:

1. Full service coverage — Exchange Online, OneDrive, SharePoint Online and Teams, including metadata, permissions and folder structure.
2. Automated, frequent backups — several times a day, with no manual intervention.
3. Configurable long-term retention — aligned with your legal and contractual obligations.
4. Immutability — copies that cannot be deleted or altered during the retention period, not even by a compromised administrator.
5. Granular restore — from a single email to an entire site, restorable in place or to an alternative location.
6. Monitoring and reporting — alerts for failed jobs and clear visibility over backup status.
7. Regular testing — an untested backup is only an assumption. Verification restores should be scheduled, not improvised.

The compliance dimension

For organisations in scope of NIS2, Article 21 requires business continuity measures, including backup management and disaster recovery. A Microsoft 365 tenant without independent backup is difficult to defend in an audit. The same logic applies to GDPR expectations around the availability and integrity of personal data.

Beyond compliance, the business case is straightforward: the cost of a Microsoft 365 backup solution is marginal compared with the cost of rebuilding — or being unable to rebuild — a company's correspondence, contracts and project documentation.

Start with an honest assessment

Before choosing a product, answer a few questions. How long can you operate without access to email? How many hours of work are you prepared to lose? Who tests recovery, and how often? Do you have an inventory of critical data and where it lives?

If the answers are vague, the risk already exists — it simply has not been triggered by an incident yet. Reviewing your current configuration, defining recovery objectives and deploying a dedicated backup solution for Microsoft 365 are steps that are far cheaper to take in advance. A team that understands both the platform and the compliance requirements applying in Romania can help you move from assumptions to verifiable certainty.