Work out what Microsoft 365 doesn't back up for you
Someone asked "doesn't Microsoft back that up?" and you need a clear answer for your tenant.
- You get
- A workload-by-workload table of what's covered and what isn't, and a two-sentence answer for leadership.
- Works in
- ChatGPT
- Claude
- Copilot
- Gemini
Fill in the blanks
A few words each is enough. Leave a blank empty and the assistant will ask you or assume.
Describe, don't paste: no CUI, personal data, hostnames, IP addresses or credentials. What you type stays on this page until you copy it or open it in an assistant.
Your prompt0 of 5 filled
Explain the Microsoft 365 shared responsibility model for data protection in plain English, then apply it to us. - Workloads we use: [Exchange Online / SharePoint / OneDrive / Teams / Entra ID] - Plan: [E3 / E5 / Business Premium / G3 / G5] - Cloud environment: [Commercial / GCC / GCC High / DoD] - Retention requirement: [How long, e.g. 7 years for contracts] - Current backup: [Third-party tool, or "none"] Make a table: workload, what Microsoft's native retention and recycle bins cover and for how long, what's not covered (ransomware, a malicious admin, accidental purge, retention gaps), and whether we need a separate backup for it. Mention Microsoft's own paid Microsoft 365 Backup service and whether it's offered in our cloud environment; say if you aren't sure. End with a two-sentence answer I can give leadership. Some details above are still in square brackets. Ask me for them before you answer, rather than guessing.
Before you paste
Read what comes back as a first draft. Check every claim about your own environment and any regulation it cites.
Then check the answer
Microsoft 365 backup guide
Where Microsoft's responsibility ends
More planning prompts
All 28 prompts- Check your backups against the 3-2-1-1-0 ruleYou want to know whether your backup copies would survive ransomware that goes after backups first.
- Set RTO and RPO tiers for your systemsLeadership wants recovery targets and you need a defensible way to set them system by system.
- Plan and record a restore testYou need to prove backups actually restore, for yourself and for an assessor or insurer, not just that the jobs succeeded.
- Review your disaster recovery plan like an auditorYou have a DR plan, but it hasn't been tested or read critically in a while.
- Check whether your AI data can be recoveredYour team uses AI tools, vector databases or agents, and no one has asked what happens if that data is lost or poisoned.
Want a person to check the answer?
AI gets you a first draft. A KELYN engineer can tell you whether it would hold up in an assessment or a real recovery.