Microsoft 365SaaS BackupData Protection
What Microsoft 365 Protects, and What It Leaves to You
Under Microsoft's shared responsibility model, Microsoft runs the service and you protect the data. Eight questions show whether your Microsoft 365 backup is ready.
- Published
- Reading time
- 3 min read
- Author
- KELYN Technologies
Microsoft 365 is one of the most reliable services most organizations use. That reliability is easy to mistake for backup. They aren't the same thing.
The shared responsibility model
Under Microsoft's shared responsibility model, Microsoft is responsible for the service: its infrastructure, availability and resilience. Your organization is responsible for its data and accounts: recovering from deletions, ransomware and bad changes, and keeping data as long as you need it.
In practice, that splits like this:
| Risk | Who owns it |
|---|---|
| Service infrastructure and uptime | Microsoft |
| Accidental or malicious deletion | You |
| Ransomware and compromised accounts | You |
| Data loss inside Microsoft 365 | You plan for it |
| Long-term retention and compliance | You define it |
Eight questions to ask
- Are your backup copies stored outside your Microsoft 365 tenant?
- Are those copies immutable, so ransomware or a compromised admin can't change them?
- Can you restore to a point in time: one mailbox item, one file, one Teams channel?
- How long do you keep backups, and does that meet your retention and compliance requirements?
- Who monitors backup jobs every day, and who runs the restore when you need one?
- When did you last test a restore, and how long did it take?
- Are Entra ID users, groups and policies protected too? Nobody signs in to Microsoft 365 without them.
- Do you know how close your mailboxes are to Exchange Online storage limits?
Any you can't answer with confidence is a gap worth closing before you need a restore.
Why "outside the tenant" matters
Backups that live in the same tenant as the data share its fate. If an attacker gets admin access, or data is lost inside the service, copies kept elsewhere are the ones that survive. Immutable copies in isolated storage outside your tenant give you something to recover from after an attack.
How KELYN handles it
Microsoft 365 backup from KELYN uses Commvault to protect Exchange, Teams, OneDrive and SharePoint, with point-in-time recovery and long-term retention. KELYN licenses, deploys, manages and supports the service, with dedicated support from certified engineers based 100% in the United States.
The full Microsoft 365 backup guide has the complete responsibility table and a download to share with your team.