Microsoft & Cloud

Microsoft 365 backup gaps: what Microsoft doesn't protect and how to close them

28 June 2026Brendan9 min read

Microsoft 365
Backups
Disaster Recovery
Newcastle

Flat editorial illustration representing Microsoft 365 backup and data protection gaps

Microsoft 365 is reliable—but shared responsibility means your data is your problem. Native retention, recycle bins, legal hold, third-party backup, and what Australian businesses should test before an incident.

Plenty of Australian businesses moved email and files to Microsoft 365 and quietly stopped thinking about backups. The platform is reliable—but “Microsoft hosts it in the cloud” is not the same as “we can restore Tuesday’s mailbox if someone wipes it on Friday.” Microsoft’s shared responsibility model puts your data lifecycle in your court. Most gaps show up after accidental deletion, a disgruntled admin, or ransomware—not during a calm Tuesday.

This guide explains what Microsoft 365 actually covers, where native retention stops, and how to close the holes without paying twice for the same outcome. Layer 3 maps tenant configuration, retention, and Datto SaaS Protection backup for clients across Newcastle and nationally—so recovery is a plan, not a prayer.

Quick answers

Does Microsoft back up my Microsoft 365 data?

Microsoft guarantees service availability and has infrastructure resilience—it does not provide unlimited point-in-time backup of your tenant the way a dedicated backup product does. You are responsible for protecting your data: retention, legal hold, and optional third-party backup fill different roles.

What is the biggest Microsoft 365 backup mistake?

Assuming recycle bins and short default retention are enough. Deleted items expire, admin actions bypass user recycle bins, and Teams/SharePoint/Exchange have different retention paths—misconfiguration leaves silent gaps.

When do I need third-party Microsoft 365 backup?

When you need granular restore (single mailbox, file, or Teams message) beyond native windows, long retention for compliance or insurers, protection against malicious admin or ransomware mass-delete, or evidence you can restore on demand. Many SMBs use a blend of native retention plus third-party backup for critical workloads.

Are litigation hold and backup the same thing?

No. Legal hold preserves items for compliance—it is not a user-friendly restore path for operational recovery, and it is not a substitute for tested disaster recovery or immutable off-site copies.

What should Australian businesses document for M365 recovery?

What must be restorable (mail, SharePoint, OneDrive, Teams), acceptable data loss (RPO) and downtime (RTO), who can authorise a restore, and proof that a restore test worked—especially if personal information is involved under the Privacy Act or NDB scheme.

Shared responsibility in plain language

Microsoft keeps the lights on: datacentres, platform uptime, patching the service. You keep the content safe: retention policies, access control, backup strategy, and recovery drills. That split is spelled out in Microsoft’s shared responsibility documentation—SaaS availability is not the same as your right to roll back a folder someone deleted six months ago.

For the wider picture on backup and disaster recovery, identity and immutable copies matter as much as mailbox backups—Maersk’s NotPetya recovery hinged on domain controllers, not Exchange alone.

What Microsoft 365 gives you natively

Native tools are useful—when deliberately configured. Out of the box defaults are rarely enough for a regulated or operationally critical business.

Service availability and geo-redundant platform infrastructure.
Recycle bins and deleted-item retention—for a limited time, varying by workload.
Retention policies and labels—for compliance-oriented keep/delete rules.
Litigation hold / eDiscovery—for legal and investigation scenarios, not everyday restore.
Version history in SharePoint/OneDrive—helpful for files, not a full tenant backup strategy.
Microsoft Purview features (licensing dependent)—governance, not a fire drill substitute.

Common gaps—where businesses get caught

Short or missing retention

Policies that delete mail after 30 days, or never applied to all workloads, mean data is gone before anyone notices. Teams chat, SharePoint sites, and OneDrive often need explicit policy coverage—not assumed inheritance.

Recycle bin confusion

Users expect “delete” to mean recoverable forever. Exchange deleted-item windows, SharePoint second-stage recycle bin timing, and admin purges behave differently. An admin emptying a mailbox is not the same as a user deleting an email.

Accidental and malicious deletion

Fat-fingered bulk deletes, compromised admin accounts, and ransomware that targets cloud tenants all happen. Native tools struggle when entire libraries or mailboxes are cleared quickly—especially if retention was not already holding content.

Teams and modern collaboration data

Teams spans Exchange mailboxes, SharePoint sites, and chat. Restoring “the conversation from March” is not one click unless you planned for Teams data in retention and backup scope.

Tenant misconfiguration and sync tools

Bad migrations, third-party sync apps, and automation scripts can overwrite or duplicate data at scale. Backup without configuration baseline makes rollback harder.

Compliance vs operational recovery

Legal hold preserves—but restoring Tuesday’s operations from hold is slow and the wrong tool. Insurers and auditors increasingly ask for restore tests, not just policy PDFs.

Thinking cloud means off-site backup

Your M365 tenant is off-site from your office—but it is still a single logical production environment. Ransomware and admin mistakes can affect the whole tenant. Off-site and immutable backup still applies; it just looks like a backup vendor or second region—not a tape in the cupboard.

Closing the gaps—a practical stack

Step 1: Know what you must recover

List critical workloads: CEO mailbox, finance SharePoint, CRM exports, Teams channels with client comms. Assign rough RPO/RTO—how much loss and downtime you can tolerate per system.

Step 2: Configure native retention deliberately

Apply retention policies or labels to the workloads that matter; avoid “default only.” Align delete periods with legal and insurer requirements—not with whatever shipped in the tenant.

Step 3: Add third-party M365 backup where gaps remain

Layer 3 primarily deploys Datto SaaS Protection for Microsoft 365 and Google Workspace—automated backups, granular restore, and an independent copy stored outside Microsoft or Google’s production environment. We assess whether native retention alone is enough before adding licences; the goal is closing real gaps, not selling overlap.

Step 4: Protect identity and endpoints too

M365 backup does not replace Entra ID hygiene, MFA, or endpoint protection. A restored mailbox in a still-compromised tenant is a short-lived win.

Step 5: Test restores

Quarterly for critical data: restore a mailbox item, a SharePoint folder, a Teams message—log the result. Untested backup is optimism.

When you need it back: Datto SaaS Protection in practice

Policy slides are easy; payroll week is when backup earns its keep. Layer 3 uses Datto SaaS Protection as our primary SaaS backup service for client tenants—Microsoft 365 and Google Workspace alike. Datto takes automated backups multiple times daily and keeps an independent copy outside Microsoft and Google servers, with point-in-time and granular restore when someone deletes the wrong thing—or when ransomware touches cloud data.

Picture a typical scenario we see in Australian SMBs: finance and admin work living in Microsoft 365—Outlook for supplier and ATO correspondence, SharePoint for month-end workpapers and shared accounting files. A user bulk-deletes a SharePoint library, syncs the wrong OneDrive folder, or an admin empties a mailbox during cleanup. Native recycle bins and retention either do not cover the item or the window has already closed. The business does not need a lecture on shared responsibility; they need last Tuesday’s files back before BAS or payroll.

With Datto SaaS Protection already in place, Layer 3 identifies the affected mailbox, site, or library in the backup console, selects a restore point from before the loss, and recovers at the right granularity—single email, folder, or SharePoint document set—without destructive overwrites of what is still good in the live tenant. Exchange, OneDrive, SharePoint, Teams, and calendars are in scope for Microsoft 365; Gmail, Drive, shared drives, contacts, and calendars for Google Workspace on the same model. That is the difference between “we might find it in hold” and a planned operational restore.

The same product line applies if your estate is Google-first instead of Microsoft—backup and restore behaviour is consistent, which matters when you standardise support and runbooks across clients. See Datto’s SaaS Protection overview for full workload coverage; we align tenant onboarding and restore drills to what your licences actually protect.

Standalone lesson: third-party SaaS backup is not about fear-selling—it is about recovery time when native tools stop. Datto gives us the restore paths; Layer 3 gives you the runbook, testing, and someone to answer the phone when finance says the folder is gone.

Australian context

Under the Privacy Act and Notifiable Data Breaches scheme, loss or unauthorised access to personal information may require assessment and notification. “We could not restore client records” is a bad place to start that conversation. Documented retention, backup, and restore evidence supports both compliance conversations and cyber insurance questionnaires—without replacing legal advice.

How Layer 3 helps

We audit what your tenant actually retains versus what leadership assumes is protected, recommend native policy fixes, and deploy Datto SaaS Protection where it earns its keep. The same team handles Microsoft 365 day-to-day, disaster recovery planning, and restore tests—so gaps do not sit between vendors.

Newcastle-based engineers; national delivery. We prefer proven, supportable stacks over shelfware that never gets tested.

FAQ

Is OneDrive the same as backup?

OneDrive is sync and share with version history—not a separate backup product. Ransomware, admin deletion, or retention gaps can still remove what you thought was safe.

How long does Microsoft keep deleted email?

It depends on mailbox type, retention policies, and litigation hold—not a single universal number. Deleted Items and recoverable items windows apply; unconfigured mailboxes may lose data sooner than you expect.

Can we rely on litigation hold instead of backup?

Hold is for preservation and legal scenarios. Operational recovery and fast granular restore need retention plus backup designed for that job.

Does Business Premium include everything we need?

Licensing unlocks features—it does not auto-configure them. Most tenants need explicit retention labels/policies and a decision on third-party backup for critical data.

What about archived mailboxes and inactive users?

Plan for leavers: inactive mailboxes, litigation hold, or export—otherwise licences and data become a tangled cost and recovery risk.

How does Layer 3 backup Microsoft 365 without duplicating spend?

We map overlap first: native retention for compliance tiers, Datto SaaS Protection where granular or long restore is required—one runbook, one support path, restore tests logged for critical sites.

Request a tenant backup review: Contact Layer 3.

← Back to all articles