Module 8 of StartCloud's Microsoft 365 Security Essentials learning pathway, in five short units with a knowledge check: the shared responsibility model and why 'it is in the cloud so it is backed up' is wrong, the real Microsoft retention windows (93 days for SharePoint and OneDrive, 14 days by default for email, 30 days for a deleted account), the four ways data actually disappears (deletion, departures, ransomware syncing encrypted files, sync errors), and what separates a genuine third-party backup from a recycle bin.
Backups: What Microsoft Does Not Do For You
The sentence that costs people money
There is one sentence that turns up in almost every conversation about lost data, and it is always said with complete confidence: "it is in the cloud, so it is backed up."
It sounds obviously true. Microsoft runs enormous data centres, they replicate everything, the service has not fallen over in years. All of that is real. It is just answering a different question to the one you actually care about.
Keeping the service running. Their hardware, their data centres, their uptime. If a disk dies in a Microsoft building, that is their problem and you will never hear about it. This is the part they are genuinely excellent at.
The data inside it. If someone in your business deletes the wrong folder, or an account gets taken over and wipes a mailbox, that is not a Microsoft outage. The service worked perfectly. It did exactly what it was told, by someone with permission to tell it.
Every cloud provider works this way, and Microsoft publishes it openly. They are responsible for the infrastructure. You are responsible for your data, your accounts, and your access controls. Nobody hides it. It is just that almost nobody reads it before they need it.
Here is the thing worth sitting with for a second. Microsoft does give you some safety nets, and they are genuinely useful. Recycle bins, retention windows, a grace period on deleted accounts. Plenty of businesses have been saved by them.
The trouble is that people assume those safety nets are a backup, and they are not the same thing. A backup is a separate copy you control, kept for as long as you decide, restorable on demand. What Microsoft gives you is a set of short timers. Next unit, we look at exactly how long those timers run, because the numbers surprise people.