When we take over a new firm, one of the first questions we ask is how their Microsoft 365 data is backed up. The most common answer is that Microsoft does it. The second most common answer is a pause.
Microsoft does a lot. It runs the service across multiple data centers, it keeps copies so that a failed disk on its side doesn’t cost you an email, and it keeps the lights on with an uptime record most firms could never match on their own servers. What it doesn’t do, unless you buy a separate product and switch it on, is keep an independent, point-in-time copy of your firm’s mail and files that you can restore from whenever you need to.
Microsoft calls this the shared responsibility model. Microsoft is responsible for the service. You are responsible for your data, your accounts and who can get to them.
What Microsoft actually keeps
Microsoft 365 has recovery features, and they’re useful. They’re just short.
- Deleted email. When someone empties their Deleted Items folder, the messages can usually be recovered for 14 days by default. An administrator can extend that to 30. After that, they’re gone.
- A departed user’s OneDrive. When an account is deleted, its OneDrive is kept for 30 days by default, then held for a further 93 days where only an administrator can restore it. After that, it’s permanently deleted.
- SharePoint and OneDrive files. Deleted files go to a recycle bin, and earlier versions of a file are kept, which helps with an accidental overwrite.
Every one of those has a clock on it, and the clock starts when the mistake happens, not when somebody notices it.
Four ways firms lose data inside a healthy tenancy
None of these involves Microsoft doing anything wrong.
- The departure nobody checked. An associate leaves. Their account is deleted as part of offboarding, which is the right thing to do. Four months later, a partner needs a file that only ever lived in that associate’s OneDrive. The retention window closed weeks ago.
- The quiet deletion. Someone deletes a folder of matter correspondence, by mistake or otherwise, and nobody notices until a deadline brings someone looking for it. If that’s more than a few weeks later, there’s nothing left to recover.
- Ransomware on a synced folder. A laptop gets infected and encrypts the files in a OneDrive folder that syncs to the cloud. The encrypted versions sync up and replace the good ones. Version history and OneDrive’s own restore feature can roll files back, but only for the last 30 days, and only if someone notices in time.
- A compromised account. An attacker with a user’s password can delete mail, set up rules that move or forward it, and empty the recycle bin on the way out. A backup that the same account can delete isn’t much protection.
What a real backup looks like
A backup worth having for a law firm has four properties.
- It’s separate from Microsoft 365. It’s held outside your tenancy, or at least outside the reach of any one user account, so a compromised account or a mistake inside Microsoft 365 can’t delete it.
- It covers everything. Exchange mailboxes, OneDrive, SharePoint and Teams, including shared mailboxes and the accounts of people who have left.
- It keeps enough history. Long enough to cover the time it takes your firm to notice a problem, which is usually longer than anyone expects.
- It’s tested. Someone restores a mailbox or a folder on a schedule and writes down that it worked. A backup nobody has ever restored from is a belief, not a control.
Microsoft now sells its own backup product for Microsoft 365, and several established third-party products do the same job. Which one you use matters less than whether you have one, whether it covers everything, and whether anyone has ever tested it.
Why this matters more for a law firm
Your retention obligations don’t stop because a mailbox was deleted. Bar rules, client agreements and litigation holds all assume you can produce what you’re supposed to have kept. A growing number of clients now ask about it directly: “Do you back up data held in Microsoft 365, and how often are restores tested?” is one of the most common questions on the security questionnaires corporate clients send to firms.
Three questions to ask your IT provider this week
- Is our Microsoft 365 data backed up by something other than Microsoft 365 itself?
- Does it include the mailboxes and OneDrives of people who have left the firm?
- When was the last time someone restored something from it, and can I see the date?
If the answers are yes, yes and a recent date, you’re in better shape than most firms we meet. If not, it’s one of the cheaper problems in IT to fix, and one of the most expensive to discover.