A surprising number of Teesside and County Durham offices treat Microsoft 365 as the backup. Mail is in Exchange Online, files are in OneDrive or SharePoint, and the laptops themselves feel less important. That is a reasonable way to work. It is not a disaster recovery plan.
Microsoft keeps the service available. Recycle bins, version history and retention policies help with mistakes. They do not replace a copy you control, stored separately, that you have actually restored. If you want the wider picture first, start with our guide to backup and disaster recovery basics.
What Microsoft 365 actually keeps
Exchange Online and OneDrive are designed so that yesterday’s email and last week’s spreadsheet are still there this morning. If someone deletes a file, the recycle bin often holds it for a limited time. If someone overwrites a document, version history can roll it back. Those tools are useful. They are also easy to misunderstand.
Recycle bins empty. Retention labels only apply if someone turned them on and scoped them to the right sites. A user who empties their own bin, or an admin who removes a leaver’s account without a hold, can take the only copy with them. Microsoft’s own documentation is clear that customers are responsible for their data. The cloud is not an archive unless you configure it as one.
SharePoint and Teams files sit on the same foundations. A deleted Team, a removed site, or a sync client that pushed encrypted files back up to the cloud will follow the same rules. The recycle bin is a safety net for a few weeks, not a vault.
Where small North East firms get caught
The awkward cases are ordinary. Someone in accounts leaves, their licence is removed to save money, and the only copy of a supplier folder lived in that person’s OneDrive. A ransomware strain encrypts the Documents folder on a laptop that was syncing, and the encrypted files replace the good ones in the cloud. A shared mailbox is deleted because “we do not use that address any more”, and six months of customer replies go with it.
Hybrid work makes this more likely, not less. Files that used to sit on a server in the cupboard now sit in personal OneDrive libraries because that was the fastest way to share a pack. Nobody mapped who owns which library. When you come to restore, you are guessing.
Websites and line-of-business systems are a separate problem. Microsoft 365 will not bring back a WordPress site, a till export, or the SQL database behind a custom business app. Those need their own backups, usually through hosting or a proper server job.
Another quiet failure is assuming “we pay for Microsoft 365 Business Premium, so retention is on”. Licence SKUs and retention are not the same setting. Someone still has to choose how long deleted mail is kept, whether a hold applies when a person leaves, and whether Teams chat is in scope. If nobody in the office can point to those settings, they are probably still on the defaults.
- List what you must be able to recover: mailboxes, shared mailboxes, SharePoint sites, OneDrive libraries, Teams files, and anything that is not in Microsoft 365 at all
- Do not treat a leaver’s OneDrive as optional storage — move shared work into a SharePoint site the role owns
- Keep a separate copy of Microsoft 365 data if losing a month of mail or invoices would stop the business
- Confirm how long recycle bins and version history actually last on your tenant, rather than assuming they last forever
- Restore one mailbox and one library on a quiet afternoon so the first restore is not during an incident
A recovery plan that fits an SME
You do not need an enterprise backup suite on day one. You do need a written list of systems, a destination that ransomware on a laptop cannot also encrypt, and a person who knows how to run a restore. For many offices that means a Microsoft 365 backup product or service plus the device and website backups you already should have.
Write down recovery time in plain language. “We need yesterday’s invoices by lunchtime” is a requirement. “RPO 15 minutes” is not, unless you already speak that dialect. The written note should also say who is allowed to run a restore, because a backup login that only one contractor knows is another single point of failure.
Patching, MFA and a clean tenant still matter — backups are the last line, not the first. Our notes on getting Microsoft 365 basics right and SharePoint versus shared drives cover the day-to-day setup. The backup conversation is: if this vanished on Monday, how would you invoice on Tuesday?
Garvey's IT builds that picture into managed IT support from Stockton-on-Tees — mail, files, servers and website hosting under one team. We will not pretend a recycle bin is a backup. Ask for a backup review if you are not sure what you could actually restore.
Common questions
Does Microsoft 365 back up our email and files automatically?
It keeps the live service running and provides recycle bins, version history and optional retention. Those are not a full backup. Deleted mail, emptied bins and some ransomware events still need a separate copy you can restore on your timetable.
How often should a small office test a Microsoft 365 restore?
A restore of one mailbox and one SharePoint or OneDrive library each quarter is enough to prove the process works. Waiting until a real incident is how firms discover that nobody knows the login, the licence, or which folder actually held the invoices.