Many contractors assume that because their email, files, and Teams chats live in Microsoft 365, the data is automatically backed up forever. It is a reasonable assumption and a risky one. Microsoft is responsible for keeping its service available and its infrastructure secure. You are responsible for your data, who can access it, and how you recover it when something goes wrong.
Understanding that split, often called the shared responsibility model, helps you decide whether the built-in protections are enough or whether you need an additional layer.
What Microsoft provides
Microsoft 365 includes redundancy, so a hardware failure in a data center does not take your mailbox with it. It also provides retention features, recycle bins, and version history that let you recover recently deleted items. These are valuable for everyday mistakes.
Retention windows are limited and vary by service, license, and settings. Deleted items do not stay recoverable forever, and some recovery paths depend on the right configuration. Check your own tenant's settings rather than assuming.
What Microsoft does not promise
Built-in features are not designed to be a complete backup against every scenario. Common gaps include:
- Malicious deletion. An attacker or a disgruntled employee with access can delete data, and cleanup of the recycle bin may follow.
- Ransomware syncing. When a computer with OneDrive or SharePoint sync is encrypted, the encrypted files can sync up to the cloud, replacing good versions. Version history may help, but restoring thousands of files is slow.
- Account takeover. A compromised administrator can change retention settings or delete mailboxes.
- Long-term retention. Legal, contractual, or warranty needs may require holding project records for years, beyond default windows.
- Accidental overwrites that go unnoticed until after the version history window.
What contractors stand to lose
Think about what lives in Microsoft 365 at your company: project correspondence, contracts, change order approvals, drawings and submittals in SharePoint, estimating files, safety documentation, and Teams conversations that record field decisions. When a dispute or claim arises, those records can be the evidence that protects you.
Questions to answer
- How long can we recover a deleted mailbox or SharePoint site?
- If an administrator account is compromised, could the attacker destroy our recovery options?
- Could we restore a single project folder to its state from last Tuesday?
- How quickly could we restore everything if the tenant was damaged?
- Do our contracts or insurance require records retention beyond the defaults?
If you cannot answer these, you have found the gap.
Options for closing the gap
Tighten the built-in features first
- Make sure retention and recycle bin settings are configured, not left at defaults you have never reviewed.
- Enable versioning on document libraries.
- Restrict who can delete sites or change retention.
- Protect administrator accounts with multi-factor authentication and separate admin identities.
Add a third-party backup
A dedicated backup service copies mailboxes, OneDrive, SharePoint, and Teams data to a separate location under separate credentials. Look for:
- Protection stored outside your Microsoft tenant.
- The ability to restore individual items, folders, or entire accounts.
- Frequent automatic backups, typically daily or more often.
- Protection against deletion by compromised admin credentials.
- Reasonable retention options.
- Clear reporting, so you know backups are running.
Plan for ransomware on synced devices
Limit who can sync large document libraries to local computers, protect endpoints with monitored endpoint detection, and train people to report strange file behavior quickly. Know how to roll back a library to a point in time.
Test restores
Pick a project folder and a mailbox once or twice a year and restore them to an alternate location. Record how long it took and who did it. The first test often reveals surprises, such as missing permissions or an unclear process.
Document the plan
Write down where data lives, how it is backed up, who can restore it, how long recovery should take, and who decides priorities. Keep a printed copy somewhere other than the network itself.
Costs and tradeoffs
Third-party Microsoft 365 backup is typically priced per user per month and is usually small compared with the cost of losing project records. Weigh it against how much you would lose, how long you could operate without those records, and what claims or audits might require.
Getting help
Ironfield Cyber reviews Microsoft 365 retention settings and backup coverage for contractors and energy companies, and can set up and test cloud backup as part of managed IT. A single restore test is a revealing first exercise.