Backup & Disaster Recovery · June 2026 · 6 minute read

Backup isn’t a disaster recovery plan (and Microsoft isn’t backing up your 365 data)

Most business owners we talk to believe two things that aren’t quite true. The first is that having a backup means they’re covered if something goes wrong. The second is that because their email, files, and Teams chats live in Microsoft 365, Microsoft is already backing all of it up for them.

Neither is accurate — and the gap between what people assume and what’s actually happening is exactly where businesses get caught out. Here’s what’s really going on, and what to do about it.

Backup and disaster recovery are not the same thing

A backup is a copy of your data. A disaster recovery (DR) plan is what actually happens when something goes wrong — who does what, in what order, and how quickly your business is back up and running.

Having a backup without a plan is a bit like keeping a spare tyre in the boot but never checking it’s inflated, never learning how to use the jack, and not knowing which garage to call if you can’t do it yourself. The spare exists. Whether it actually gets you back on the road quickly is a different question entirely.

A proper continuity plan answers the practical questions a backup alone doesn’t:

• If our server, our main software, or our email goes down, how long can we realistically survive before it seriously hurts the business?
• Who is responsible for starting recovery, and how do we reach them if it happens at 7pm on a Friday?
• What gets restored first? (Hint: it’s rarely “everything, all at once” — some systems matter more than others in the first few hours)
• Once it’s restored, how do we know it actually worked?

Most businesses we meet have never written any of this down. They have a backup running somewhere, and an assumption that “we’ll figure it out” if it’s ever needed. The trouble is, the day you need a disaster recovery plan is the worst possible day to be improvising one for the first time.

“But Microsoft backs up our data” — a common, costly misunderstanding

This is the one that catches people out most often. If your business runs on Microsoft 365 — Outlook, SharePoint, OneDrive, Teams — there’s a natural assumption that because it’s all “in the cloud” and Microsoft is a massive, reliable company, your data must already be backed up.

It isn’t. Not in the way most people mean.

Microsoft 365 runs on what’s called a shared responsibility model, and it’s actually written plainly into Microsoft’s own service agreement above. That’s Microsoft, in their own terms, telling you it’s your job.

Here’s the distinction that trips people up: Microsoft maintains extensive backup infrastructure — geo-redundant data centres, constant replication, failover systems — but all of that exists to keep the service running, not to protect your data from being deleted, corrupted, or encrypted by ransomware.

If a data centre catches fire, Microsoft 365 keeps running because your data is mirrored elsewhere. That’s a genuinely impressive engineering achievement, and it’s not nothing. But if one of your staff accidentally deletes a folder of client files, or a ransomware attack encrypts your SharePoint site, that deletion or encryption gets replicated too. Microsoft’s systems faithfully copy whatever exists — including the version that’s been deleted or scrambled.

A few concrete scenarios this catches businesses out on:

• A staff member leaves, their account is deactivated, and after a short window their mailbox and OneDrive files are gone for good.
• An accidental deletion isn’t noticed for a few months — by the time someone goes looking for the file, it’s already passed Microsoft’s recycle bin retention window and is unrecoverable.
• A ransomware attack specifically targets and deletes version history and recycle bin contents first, before encrypting everything else — a tactic designed to remove your easy way out.

None of this is a flaw in Microsoft 365. It’s simply not what the product is built to do. Microsoft protects the platform. You’re responsible for protecting your data on it — which is exactly why a genuine third-party backup for Microsoft 365 (separate from Microsoft’s own infrastructure, with its own retention and recovery options) is something we recommend to every client who relies on it for day-to-day work.

What good backup and DR actually looks like for a small business

You don’t need an enterprise-grade setup to be properly protected. For most small and medium businesses, a sound approach covers:

• Backup that’s independent of your everyday systems — including a proper third-party backup for Microsoft 365 data, not just Microsoft’s native retention settings
• Regular, automatic backups that don’t rely on someone remembering to run them
• Tested recovery — a backup you’ve never actually tried restoring from is a backup you’re hoping works, not one you know works
• A simple, written plan for what happens if your systems go down: who’s contacted, what gets prioritised, and roughly how long recovery should take
• Clarity on your recovery time — how long you can realistically afford to be without a system before it seriously affects the business

None of this needs to be complicated or expensive to be effective. It just needs to actually exist, and actually be tested — rather than being something everyone assumes is “probably fine.”

Where to start

If you’re not sure whether your current backup actually covers what you think it does — particularly for Microsoft 365 — that’s worth a straightforward conversation, not a guessing game. We can walk through what’s actually being protected today, where the gaps are, and what a sensible, right-sized continuity plan looks like for a business your size.

Sources: Microsoft’s published shared responsibility model documentation and Services Agreement; industry analysis from AvePoint, Veeam, and EPC Group on Microsoft 365 native retention limits and backup best practices (2026).

← Back to all posts