Published 23 October 2026 · By Blackgate Tech
Most small businesses think that because their email and files live in Microsoft 365, Microsoft is backing them up. It isn't. Not in the way you'd expect.
Microsoft's job is to keep the service running: servers, data centres, uptime. Your job is to look after the data inside it. Microsoft calls this the shared responsibility model, and it's set out in its own service agreement. Most SMBs only find out about it when someone needs a file that's already gone.
Here are the five gaps we see most often, and what to do about each one.
Deleted files in OneDrive and SharePoint go to a recycle bin that empties after 93 days. Deleted emails usually stay recoverable for 14 days by default, and 30 at most. That's fine if someone notices the next morning. It's no help when a client asks for a contract from last year, or when an email thread was deleted months ago and nobody noticed.
Fix: A proper backup keeps copies outside the recycle bin, for as long as you decide, not for whatever a default setting allows.
When someone leaves, the usual move is to delete their account and free up the licence. Once the account is deleted, you have about 30 days before their mailbox and OneDrive are gone for good. After that, every client email, quote and file they handled is unrecoverable.
Fix: Back up every account before it's removed, and build that step into your offboarding checklist. Then you can drop the licence without losing the history.
People often assume OneDrive protects them from ransomware. In practice, if a laptop gets encrypted, OneDrive syncs the encrypted files up to the cloud and replaces the good copies. OneDrive's restore tool can help, but only within a limited window and only if someone spots the problem in time.
Fix: Keep an independent backup, stored separately from your Microsoft 365 tenant, that ransomware can't reach or overwrite.
Not all data loss is dramatic. Someone overwrites a shared spreadsheet, a sync tool deletes a folder, or an unhappy employee quietly clears out a SharePoint library before leaving. By the time anyone notices, the built-in retention window has often passed.
Fix: Daily automated backups with point-in-time restore, so you can roll back a single file, a mailbox or a whole site to how it was on a given day.
UK GDPR requires you to be able to restore access to personal data in a timely way after an incident. Regulated firms such as law, healthcare, finance and recruitment often have retention rules of their own on top of that. "Microsoft has it" won't satisfy an auditor, the ICO or your cyber insurer.
Fix: Have a documented backup, a defined retention period, and a restore you've actually tested. Insurers increasingly ask about all three.
None of this needs a big budget. It needs someone to set it up properly once and check it's working. If you're not sure whether your Microsoft 365 data is actually protected, we're happy to take a look. Blackgate Tech offers a free backup check for London SMBs. Get in touch to book one.