Microsoft 365 Does Not Back Up Your Data: What That Costs an Orlando Business

November 15th, 2026

Hurricane season ends November 30. That is the deadline most Orlando businesses plan around. The data loss that actually takes companies down rarely waits for a named storm. It arrives as a deleted shared drive, a departing employee, a ransomware event, or a sync client that mirrored a local deletion across every device before anyone noticed.

In each of those cases, the business expects Microsoft 365 to have a copy. Usually it does not. Microsoft 365 keeps data available. It does not keep it recoverable on your terms, and the difference is expensive to learn in the middle of an incident.

What Microsoft actually promises

Microsoft's shared responsibility model puts service availability and infrastructure security on Microsoft's side, and data, identities, and configuration on the customer's side. Microsoft runs the data centers, keeps Exchange and SharePoint online, and maintains copies for service continuity. It does not promise to restore a mailbox, a SharePoint library, or a OneDrive folder to the state it held two months ago because an employee deleted it or a bad sync overwrote it.

That is not a loophole. It is the product. Retention, version history, and the recycle bin are features designed to help with short-term accidents and compliance holds. None of them is an independent backup, and Microsoft's own documentation says so.

The February 2026 reminder

In February 2026, Microsoft deleted Microsoft 365 data belonging to nonprofit organizations whose donated Business Premium grants had ended. According to reporting at the time, a Microsoft email told an affected customer that the remaining data was deleted due to an error before the normal retention window expired, that recovery attempts had failed, and that the data could not be recovered. The company could not even confirm what had been lost. The organizations were offered help setting up a new tenant, not a way to get their files back.

Read that sequence again. A platform-level mistake, a failed recovery, an empty answer about what disappeared. A business that assumes Microsoft has a backup has no leverage in that situation. A business with its own independent copy has a restore job.

Retention is not backup

The confusion usually starts with the recycle bin. The defaults look generous until you read them closely:

• Exchange Online keeps deleted items for 14 days by default, with another 14 days in recoverable items, for roughly 30 days total.
• SharePoint and OneDrive keep deleted files in the recycle bin for 93 days by default.
• Version history keeps a limited number of prior versions, and those versions live in the same tenant as the original.

Three problems follow. First, a retention or deletion policy in Microsoft Purview is designed to delete content everywhere it lives, including copies in mailboxes and sites. That is what the policy is for. Second, a compromised administrator account can remove data and the retention settings that protect it. Third, a ransomware event or a bad sync can overwrite or encrypt files faster than a retention window helps, and the backup you need is the one from before the event, held somewhere the attacker cannot reach.

Retention also has a legal edge. If your industry or a contract requires you to keep records for seven years, a 93-day recycle bin is not a records retention program. And if litigation is reasonably anticipated, deleting data under a routine retention policy can become a spoliation problem. A real backup with defined retention is how you satisfy both the keep-it requirement and the delete-it-on-schedule requirement without guessing.

What a loss actually costs an Orlando business

Orlando's economy mixes hospitality, healthcare, construction, professional services, and defense work. Each has a different version of the same bad day. A hotel management company loses the group contracts and rate sheets it spent a year negotiating. A medical practice loses scheduling history and patient correspondence. A contractor loses bid documents, submittals, and change orders. A defense subcontractor loses the project files that have to be produced for an audit.

Put a number on a 40-person firm. Assume email is down for half a day, the shared project files are gone for two days, and the office manager spends a week rebuilding calendars, contacts, and permissions. Add the staff hours, the missed deadline, the client who takes the next job elsewhere, and the owner's time spent on something other than running the business. The direct bill is usually tens of thousands of dollars. The reputational bill is larger and harder to see.

Then add the cases that do not show up on an invoice. A ransomware event without a clean restore can force a notification obligation, an insurance claim, and a forensic investigation. A missing email thread can decide a contract dispute. A lost SharePoint library can take months to reconstruct, and some of it will never come back.

Microsoft 365 Backup helps, but read the scope

Microsoft now sells Microsoft 365 Backup, a pay-as-you-go service that protects Exchange Online, OneDrive, and SharePoint. It is a genuine improvement over doing nothing, and for some businesses it is the right first step. It is also narrower than the name suggests:

• It does not cover Teams chat messages, which is where a large share of day-to-day decisions now live.
• It keeps a fixed one-year retention period, with a 90-day grace period after a license is removed. If your legal or contractual retention is longer, it does not meet the requirement.
• It runs inside your Microsoft tenant, under Microsoft's control, which is the same trust boundary that failed in the February 2026 deletion.
• Restore throughput is not instant. One 2026 analysis put Microsoft's service at roughly 1 to 3 TB per hour, which means a large tenant can take days to restore even when everything works.

For a small Orlando business with a modest mailbox and file estate, Microsoft 365 Backup plus a tested procedure may be enough. For a business with regulated data, long retention obligations, Teams-dependent operations, or a low tolerance for downtime, it is one layer, not the whole plan.

What a real backup looks like

A backup worth the name has four properties. It is independent of the tenant it protects, so a compromised Microsoft account cannot delete it. It is immutable for a defined period, so ransomware cannot encrypt it and an administrator cannot quietly rewrite it. It covers the workloads you actually use, including email, OneDrive, SharePoint, Teams, and the configuration that makes them work. And it is tested, because an untested backup is a guess.

The operational details matter as much as the product:

• Inventory every workload and assign an owner. Email, OneDrive, SharePoint, Teams, Entra ID, and any line-of-business app connected to Microsoft 365 all count.
• Set retention to the longest requirement that applies to you, whether that is a regulator, a contract, or counsel's litigation hold.
• Restrict who can delete data and who can change backup policy. Those should not be the same handful of accounts.
• Require multi-factor authentication and conditional access for every administrator, and keep a break-glass account documented and offline.
• Run a restore test at least quarterly, and record how long it took. The number you measure is your real recovery time, not the one in the vendor's brochure.
• Keep an offline or out-of-band copy of the recovery plan, because the plan is useless if it lives only in the tenant that is down.

This is the same 3-2-1 discipline that has applied to servers for decades, applied to cloud data: three copies, two media or locations, one of them offsite and isolated. Microsoft 365 changed where the data lives. It did not change the math.

Check your assumptions before the next storm

Ask three questions this week. If the answer to any of them is a guess, you do not have a backup. Who can permanently delete a mailbox or a SharePoint site, and is that list reviewed? What is the retention period on your backup, and does it match your longest legal or contractual requirement? When was the last restore test, and how long did it take?

SemTech IT Solutions builds disaster recovery and business continuity plans around Microsoft 365, including independent backup, retention design, and restore testing. Our email and cloud migration services make sure the protection is in place before data moves, and managed IT services keep the backups monitored and tested after the project ends. If you want the broader picture, our guide to Microsoft 365 as a cloud platform covers what the service does well, and why backup and disaster recovery is your secret weapon explains how the pieces fit together.

The storm is not the only way to lose a business. A quiet deletion on a Tuesday afternoon works just as well. The difference is whether anyone can get the data back.