Deleted, Gone, Gone: Why Microsoft 365 Needs Its Own Safety Net

Ask most UK small business owners where their data lives and you’ll get a confident answer: “It’s all in Microsoft 365.” Fair enough. Email, Teams chats, SharePoint sites and OneDrive folders have become the default filing cabinet for everything from client contracts to the staff rota. The trouble is that “in the cloud” has quietly become shorthand for “backed up”. It isn’t. Microsoft 365 is a productivity platform with resilience built in, but it is not a backup service designed around your business’s recovery needs.

That distinction matters more than ever in 2026. Ransomware crews have worked out that sync-and-delete attacks are devastating, leavers still take data with them, and retention settings are often left at whatever Microsoft suggested during setup. If your only copy of a file is the one in Microsoft 365, and someone deletes it or encrypts it, you are relying on a recycle bin and a retention window that may be much shorter than you think.

What Microsoft 365 retention actually does

Microsoft 365 does keep data for a period after deletion. Exchange Online has a recoverable items folder, SharePoint and OneDrive have recycle bins, and version history can rescue you from some overwrites. Retention policies and litigation hold can extend that. But these are compliance and housekeeping tools, not a full backup strategy.

A retention policy might keep deleted email for 30 days. A deleted user’s OneDrive might be cleaned up after 30 days by default. SharePoint version history is not infinite. If a file is encrypted by ransomware and then synced to the cloud, the encrypted version becomes the current version. Version history may help, but only if you know when the attack started and can find a clean copy before the retention window closes. That is a lot of “if”.

The three gaps UK SMEs keep ignoring

The first gap is retention settings. Many tenants are still on default settings because nobody has reviewed them since go-live. If your retention window is 30 days and you notice a problem on day 31, the data is gone. That is not a disaster recovery plan; it is a countdown.

The second gap is deleted-user cleanup. When someone leaves, their account is often disabled and then deleted. Their mailbox and OneDrive may remain recoverable for a while, but not forever. If a client emails a former member of staff six weeks later, or a finance query needs an old invoice, you may find that the data has been tidied away. A proper offboarding process and a backup that covers former users closes that gap.

The third gap is ransomware sync-and-delete. Microsoft 365 syncs changes automatically. That is brilliant for collaboration and terrible for malware. If a laptop is infected and the ransomware encrypts files in the synced OneDrive folder, those encrypted files are uploaded. If the attacker also deletes files or empties recycle bins, you are left with a very short window to recover. A backup that takes independent, immutable copies is the difference between a bad afternoon and a business-ending event.

What to check in your tenant this month

Start with retention. Look at the retention policies applied to Exchange, SharePoint and OneDrive. Check how long deleted items are kept and whether anything is on litigation hold. Then look at the recycle bin settings for SharePoint and OneDrive, and confirm who can restore data.

Next, review admin roles. Who has Global Admin? Is it more than two people? Are those accounts protected with phishing-resistant MFA? A backup is only useful if an attacker cannot delete it, so check whether your backup solution has separate credentials and immutable storage.

Finally, test a restore. Not a backup success message, an actual restore. Pick a file, a mailbox and a SharePoint site, and restore them to a test location. Time it. Write down how long it took. If nobody has done that, you do not know whether your backup works.

What a realistic backup policy looks like

For most UK small businesses, a sensible policy covers Microsoft 365 data separately from the tenant. That means Exchange Online mailboxes, OneDrive, SharePoint and Teams. It should run automatically, store copies in a separate location, and keep them immutable for a defined period. The old 3-2-1 rule still applies: three copies, two media types, one off-site. In cloud terms, that usually means a third-party backup service with its own storage account and access controls.

Decide your recovery point objective and recovery time objective in plain English. How much data can you afford to lose, and how long can you be without it? A small professional services firm might accept one hour of lost email but want a four-hour restore. A manufacturer might need different priorities. Write it down and test against it.

Questions to ask before you trust “it’s all in the cloud”

Ask your IT provider: does our backup cover Microsoft 365 or only on-premises servers? How long are deleted items retained, and is that configured or default? Can you show me a restore test from the last three months? Who has access to the backup console, and is it protected by MFA? What happens if our tenant is compromised and the attacker deletes the backup? Is the backup immutable, and for how long?

If the answers are vague, that is your signal. The cloud is not a backup. It is a very good place to work, but it still needs a safety net.

The bottom line

Microsoft 365 is excellent at keeping your business running. It is not designed to be your last line of defence. Review your retention settings, check your admin accounts, and insist on an independent backup with tested restores. For a UK SME, that is not over-engineering. It is basic housekeeping.