This is the most common wrong belief we meet, and it is wrong in a way that only shows up on the worst possible day.
The belief goes: our email and our files are in Microsoft 365, Microsoft is a very large company, therefore our data is backed up. Every part of that is reasonable and the conclusion does not follow.
What Microsoft actually promises
Microsoft guarantees availability. Their job is that the service is up and that they do not lose your data through their own fault. They are extremely good at it.
What they do not promise is recoverability from your own actions. If you delete something, that deletion is a valid instruction and the service carries it out faithfully. Retention periods are short, measured in days or a few weeks, and once they lapse the data is gone from their side as well as yours.
The distinction in one line: availability protects you from Microsoft's mistakes. A backup protects you from yours.
The four ways this actually bites
Someone deletes something and nobody notices for two months
A folder gets tidied. A shared mailbox gets cleaned up by someone being helpful. Nobody misses it until a quarter closes or an auditor asks. By then the retention window has quietly expired.
An employee leaves and the licence gets reclaimed
This one is almost a rite of passage. The account is removed, the licence goes back in the pool to save money, and the mailbox goes with it, along with the only copy of a conversation someone needs eighteen months later. Nobody did anything wrong. The process simply had no step in it for keeping the contents.
Ransomware, syncing helpfully
Encryption happens on a laptop. OneDrive and SharePoint do exactly what they are designed to do and sync those encrypted files up. Version history helps, if you catch it in time and if the versions were not exhausted by the encryption pass itself.
An account gets taken over
Someone else is inside the mailbox. They delete the messages that would give them away, and they set a rule so the replies never appear. Recovering what they removed is not a security question at that point, it is a backup question, and it is the moment people discover which one they had.
What a real backup gives you
- A separate copy, held somewhere else, under a different set of credentials from the one that was compromised.
- Retention you chose, not a default measured in days. Years, if your industry expects years.
- Point in time recovery. Not "the current state minus what is in the bin", but the mailbox as it stood on a Tuesday in March.
- Item level restore. Getting one folder back without rebuilding an entire account around it.
This is not expensive. Per user, per month, it is one of the cheapest lines on an IT bill, and it is the one people are gladdest about roughly once every two years.
Three questions to ask this week
Ask whoever runs your IT
- Is our Microsoft 365 or Google Workspace data backed up to somewhere other than Microsoft or Google? Yes or no.
- If a mailbox was deleted ninety days ago, can we get it back? What about a year ago?
- When did we last restore something from it, as a test rather than an emergency?
The third question is the one that matters. A backup nobody has ever restored from is a belief, not a backup, and the difference between the two is discovered at the worst possible moment by definition.
The same applies to Google Workspace, and to almost every cloud application your business depends on. The vendor keeps the service running. Keeping your data recoverable is a separate job, and unless somebody has explicitly taken it on, nobody has.
What we do about it
Cloud backup is inside the flat rate for our managed clients, not an upsell, and we test restores rather than reading dashboards. We can also tell you your restore time, which is a different number from your backup status: a healthy backup of a large server can still be a multi-day restore, and that is worth knowing before the day you need it rather than during.
Not sure what you would get back?
We will look at what is actually protected, restore something as a test, and tell you honestly how long a full recovery would take. Thirty minutes, no obligation.
Book a backup checkQuestions? Email info@enlightentechhi.com or call 808-451-3630.