The shared-responsibility gap
Microsoft's Services Agreement is unambiguous: they guarantee the platform, not your data. Their job is 99.9% uptime, geo-redundant infrastructure and protection against their own failures. Your job is everything else — accidental deletion, malicious deletion, ransomware, ex-employee sabotage, retention beyond the platform's short defaults, and eDiscovery-grade point-in-time recovery.
This isn't a Microsoft flaw. Every major SaaS platform (Google Workspace, Salesforce, Xero) works the same way. The difference is that most SA businesses assume Microsoft backs things up because "it's the cloud". Then a controller deletes the wrong folder, and 4 years of contracts are gone in 93 days.
What Microsoft actually keeps (and for how long)
- Exchange Online mailbox: Deleted Items 14 days (configurable to 30). Recoverable Items 14 days (configurable to 30). After that, permanent.
- Litigation hold / retention policies: preserve mail while active — but they are compliance features, not backups, and can be turned off by an admin (or attacker).
- OneDrive: recycle bin 93 days total (30 first-stage + 63 second-stage). After 93 days, gone.
- SharePoint: site recycle bin 93 days. Deleted sites 93 days.
- Teams chat: retained per your retention policy; without one, subject to default deletion behaviour.
- Deleted user account: 30 days, then all associated OneDrive/mailbox data purged.
Real scenarios we've seen this year
- Finance manager left, HR deleted the account on day one, tax audit landed 6 months later — mailbox unrecoverable.
- OneDrive sync client on an infected laptop deleted 40,000 files; noticed on day 96. Recycle bin already emptied.
- Disgruntled ex-admin ran a PowerShell script deleting all SharePoint sites. Native retention held for 93 days — recovery cost R180,000 in professional services because backup had never been deployed.
- Ransomware encrypted OneDrive files across the org. Native version history existed but was overwritten by hundreds of encrypted revisions before detection.
Every one of these was preventable with a R60/user/month backup tool and an initial 2-hour setup.
Backup vendors for South African SMEs
- Datto SaaS Protection — market-leader for MSPs. 3× daily backup, unlimited retention, per-user pricing. Datto stores data in Azure globally; SA-based support via 1ICT.
- AvePoint Cloud Backup — deep SharePoint/Teams granularity, choice of storage region (Azure SA available for data-residency needs).
- Barracuda Cloud-to-Cloud Backup — solid, unlimited retention, straightforward pricing. Popular for legal and financial services.
- Veeam Backup for Microsoft 365 — best if you already run Veeam on-prem and want a single console; requires storage you provision.
1ICT typically recommends Datto for pure-M365 businesses and Veeam where hybrid infrastructure already exists.
Setup checklist
- Enable third-party backup covering: Exchange, OneDrive, SharePoint, Teams (chats + files).
- Set retention to at least 7 years for regulated businesses; 3 years minimum for everyone else.
- Enforce 3× daily backup frequency.
- Backup admin account is separate from Global Admin and MFA-protected.
- Test-restore a mailbox and a SharePoint site monthly. Log the result.
- Include backup verification in the monthly report to management.
- Document the restore procedure so anyone on the IT team can execute it under pressure.
Frequently asked questions
Doesn't Microsoft already back up my M365 data?
No. Microsoft's Shared Responsibility Model is explicit: they guarantee service availability and infrastructure resilience. You are responsible for data protection against accidental deletion, malicious deletion, ransomware and departing employees.
How long does Microsoft actually keep deleted items?
Mailboxes: 14 days default (extendable to 30). OneDrive/SharePoint: 93 days in the recycle bin. Teams chat: retention policy dependent. After that, gone — Microsoft cannot recover it, even if you pay them.
What does third-party M365 backup cost in SA?
R60–R120 per user per month depending on vendor and retention. For a 30-user business that's R1,800–R3,600/month — insignificant against the cost of losing 5 years of email during a legal matter.
Which backup vendor should we use?
For SA SMEs: Datto SaaS Protection, AvePoint Cloud Backup, Barracuda Cloud-to-Cloud, or Veeam Backup for M365. All four are proven; the decision usually comes down to whether you want SA-based support and Rand billing.
Do we need to back up Teams chats?
Yes, if regulated. Teams chat is now a primary communication channel; POPIA, FSCA and legal-discovery duties treat it the same as email. Native retention alone rarely meets 7-year requirements.