Microsoft 365 is a solid platform for email, files, Teams and day-to-day business work. For many Australian small businesses, it has become the main place where customer records, quotes, invoices, contracts and internal documents live.
But there is a common misunderstanding: because Microsoft 365 is in the cloud, many business owners assume Microsoft is also fully backing up everything for them. That is not quite how it works.
Microsoft does provide strong platform protection, availability and some recovery options. What it does not provide, by default, is a complete, long-term backup service designed around your business needing to recover data after accidental deletion, staff changes, ransomware or a messy admin mistake.
Retention is not the same as backup
The most important point is this: Microsoft 365 retention and Microsoft 365 backup are not the same thing.
Retention is about keeping or removing information according to rules. Those rules might keep emails for a certain period, preserve documents for compliance, or empty deleted items after a set time.
Backup is about taking a separate copy of your data so you can restore it later if something goes wrong.
That difference matters because retention settings are usually part of the same Microsoft 365 environment. If the wrong person changes the settings, an account is removed, a file is overwritten, or ransomware damages synced files, retention may not give you a clean and simple way back.
A proper backup should give you a separate recovery point. In plain English, it should let you say: “Put this mailbox, folder, file or site back to how it was last Tuesday.”
What Microsoft is responsible for
Microsoft is responsible for the Microsoft 365 service itself. That includes the cloud infrastructure, the main platform, and keeping the service available.
If a Microsoft data centre has a hardware issue, Microsoft has systems in place to keep the platform running. If there is a wider service problem, Microsoft works to restore the service.
This is important protection, but it is not the same as protecting your business from every data loss situation.
Microsoft’s job is to keep Microsoft 365 running. Your job, or your IT provider’s job, is to make sure your business data can be recovered when your staff, accounts, settings or devices are involved in the problem.
What Microsoft can restore in common situations
Microsoft 365 includes built-in recovery features that can help in some everyday cases.
Deleted emails
If someone deletes an email, it may be recoverable from Deleted Items or Recoverable Items for a limited time. The exact window depends on your settings, licence and policies.
This can be useful when a staff member accidentally deletes a recent email. It is less helpful when you discover the missing email months later, after a staff member has left, or after retention settings have already cleared it.
Deleted files in OneDrive or SharePoint
OneDrive and SharePoint have recycle bins. If a file is deleted, it may be recoverable from the first-stage or second-stage recycle bin for a period of time.
There is also version history, which can help if someone overwrites a document and you need an earlier version. This is handy for day-to-day mistakes, such as restoring an earlier copy of a proposal or spreadsheet.
However, recycle bins and version history are not the same as a separate backup. They are recovery features inside the same system.
Deleted users and mailboxes
When a user is deleted in Microsoft 365, there is usually a limited period where the account can be restored. After that, recovery becomes harder or may not be possible without a separate backup or specific retention setup.
This is where many small businesses get caught. A staff member leaves, their licence is removed to save cost, and months later someone realises their mailbox contained important client history, job notes or supplier records.
There are ways to convert a mailbox to a shared mailbox or preserve data with the right setup. But that needs to be planned before the data is gone.
Where Microsoft 365 recovery can fall short
The built-in tools are useful, but they have limits. Those limits tend to show up during stressful situations, when you need a fast and reliable restore.
Common gaps include:
- Limited recovery windows: Deleted items are not kept forever unless specific policies are in place.
- Complex restores: Finding and restoring the exact item, folder or mailbox can be slow and difficult.
- Account deletion issues: Removed users and mailboxes can become unrecoverable after Microsoft’s recovery window.
- Policy mistakes: Retention rules can be changed, misapplied or misunderstood.
- No simple full rollback: Restoring a whole site, mailbox or OneDrive to a clean point in time is not always straightforward with built-in features.
For a small business, this is not just an IT problem. It can affect cash flow, customer service and legal obligations.
If an accountant loses access to client correspondence during tax season, that is a business problem. If a tradie loses job photos, signed approvals and quote records, that is a business problem. If a retailer loses supplier order history, that is a business problem.
Ransomware and Microsoft 365
Ransomware is not only a server or desktop problem. It can affect Microsoft 365 data too.
One common path is through file sync. If a computer is infected and it is syncing files to OneDrive or SharePoint, encrypted or damaged files can sync back into the cloud. Version history may help in some cases, but recovering thousands of files can be painful and time-consuming.
Another risk is account takeover. If someone tricks a staff member into giving away their password, the attacker may access mailboxes, delete emails, create forwarding rules, or damage files.
Microsoft has strong security features, especially when properly configured. Multi-factor authentication, sign-in rules, security alerts and sensible permissions all help reduce the risk.
But if data is damaged or deleted, security tools do not replace backup. You still need a clean copy to restore from.
Accidental deletion is still the most common risk
Not every data loss event is a cyber attack. Many are simple mistakes.
A staff member deletes the wrong folder. Someone cleans up an old SharePoint site and removes active files. A manager removes a departed user without checking what data should be kept. A shared mailbox is changed and important history disappears.
These are normal business mistakes. They happen in busy workplaces, especially where people are wearing multiple hats and do not have time to think through every IT consequence.
The question is not whether your team will ever make a mistake. The question is whether that mistake becomes a ten-minute restore or a week-long headache.
SharePoint and OneDrive need special attention
Many small businesses now use SharePoint and OneDrive without realising it. Files inside Microsoft Teams are often stored in SharePoint. Desktop and Documents folders may be syncing to OneDrive. Shared company files may be spread across multiple Teams, sites and user accounts.
This can be very convenient, but it also means business records are no longer sitting in one obvious file server.
A good backup approach should cover:
- Exchange Online mailboxes, including shared mailboxes
- OneDrive accounts for current and departed staff
- SharePoint sites used by Teams and departments
- Files, folders, versions and permissions where practical
- Clear restore options for individual items and larger recovery jobs
It is also worth reviewing who can delete large amounts of data. In a small business, convenience often leads to too many people having broad access. That makes mistakes and account compromise more damaging.
Deleted mailboxes: plan before staff leave
Departing staff are one of the biggest Microsoft 365 backup and retention blind spots.
When someone leaves, businesses often want to remove their licence quickly. That makes sense from a cost point of view, but it can create data risk if the mailbox, OneDrive files and Teams access are not handled properly.
Before deleting an account, you should know:
- Does the mailbox contain client or supplier history?
- Should it be converted to a shared mailbox?
- Who needs access to the user’s OneDrive files?
- Are any business documents stored only in that user’s account?
- How long does the business need to keep this data?
This does not need to be complicated. It just needs to be part of an offboarding checklist, not an afterthought.
Why restore testing matters
A backup is only useful if it can be restored.
Many businesses have some form of backup in place, but no one has tested it for months or years. That is risky. The worst time to find out a backup is incomplete is when a client file, legal document or full mailbox is urgently needed.
Restore testing should answer practical questions:
- Can we restore one email?
- Can we restore a whole mailbox?
- Can we recover a deleted SharePoint folder?
- Can we restore OneDrive files for a staff member who has left?
- How long does it take?
- Who knows how to do it?
For small businesses, this does not have to be an enterprise-level exercise. Even a scheduled test a few times a year is far better than hoping everything works.
What Australian small businesses should do
If your business relies on Microsoft 365, you should treat backup as part of your normal risk management. It sits alongside insurance, locks on the doors, payroll checks and keeping financial records.
A sensible approach includes:
- Check current Microsoft 365 retention settings. Know what is kept, for how long, and what happens when users are deleted.
- Review departed staff processes. Make sure mailboxes and OneDrive data are handled before accounts are removed.
- Back up Microsoft 365 separately. Use a backup system that covers mailboxes, OneDrive and SharePoint.
- Limit unnecessary access. Give staff the access they need, not broad access to everything.
- Turn on strong sign-in protection. Multi-factor authentication should be standard for every user.
- Test restores. Make sure you can recover real data, not just see that a backup job says successful.
The aim is not to make Microsoft 365 harder to use. The aim is to make sure your business can recover quickly when something goes wrong.
The bottom line
Microsoft 365 is reliable, but it is not a complete backup plan by itself. Microsoft keeps the platform running and provides useful recovery features, but your business still needs to think about deleted data, departed staff, ransomware, SharePoint, OneDrive and restore testing.
If you are not sure what would happen if a mailbox, folder or SharePoint site disappeared tomorrow, it is worth checking now rather than during a crisis.
JCPIT Support helps Australian small businesses review Microsoft 365 security, backup and recovery in plain English. If you would like to know where you stand, book a free security check with JCPIT and we will help you identify any gaps before they become expensive problems.
