Cloud providers like Microsoft keep the infrastructure running reliably. But under the shared responsibility model, protecting your data from accidental deletion, ransomware and user error is your responsibility, not theirs.
Cloud services like Microsoft 365 are reliable. Microsoft guarantees 99.9 percent uptime, which sounds almost perfect. But 99.9 percent still allows for nearly nine hours of downtime per year. And when that downtime hits during your busiest period, the impact on your business is immediate.
More importantly, there is a fundamental misunderstanding most business owners have about cloud services. They assume that because their data is in the cloud, it is fully protected. It is not, and the providers themselves are very clear about this.
The shared responsibility model
Every major cloud provider operates on what they call a shared responsibility model. The provider is responsible for keeping the infrastructure running, the servers online, the data centres secure and the platform available. That is their job and they do it well.
Your responsibility is everything else. Protecting your data from accidental deletion, ransomware, malicious insiders, user error and compliance requirements. The provider gives you the platform. What happens to your data on that platform is on you.
Microsoft's own service agreement states this explicitly. They recommend using third-party backup solutions to protect your data. They are not hiding it. Most businesses just never read that part.
What an outage actually looks like
When a cloud service goes down, your team cannot access email, files, Teams or any cloud-hosted applications. Depending on the outage, this could last minutes or hours. In rare cases, it has lasted a full day.
During that time, your business is effectively frozen. Emails do not come in or go out. Files stored in OneDrive or SharePoint are inaccessible. Teams calls and meetings cannot happen. Any cloud-based business application stops working.
If your team has no offline access to critical files and no alternative communication channel, there is nothing to do but wait.
Data loss is a separate risk from downtime
Downtime is temporary. Data loss can be permanent. While major cloud outages rarely result in data loss, other scenarios do.
A staff member accidentally deletes a critical folder. Ransomware encrypts files that sync to the cloud. A departing employee deletes their mailbox contents. An admin misconfigures a retention policy and data is purged. A malicious actor gains access and exfiltrates or destroys data.
In all of these cases, the cloud provider's infrastructure was working perfectly. The data loss happened at the user level, which is your responsibility under the shared responsibility model.
What Microsoft 365 does and does not protect
Microsoft 365 includes some built-in recovery features. Deleted files go to a recycle bin for 93 days. Email has a recoverable items folder for 30 days. OneDrive has version history going back 30 days.
These features are helpful for simple mistakes but they have significant limitations. They do not cover your email, calendar, Teams data and SharePoint comprehensively. They have fixed retention windows that cannot be extended. They do not protect against ransomware that has been present for longer than the retention period. And they do not provide a single, complete restore point for your entire environment.
A proper backup solution fills these gaps by taking independent copies of your data, storing them separately from your production environment and retaining them for as long as you need.
How to reduce your exposure
The most important thing you can do is stop assuming the cloud provider has it covered. They have the infrastructure covered. Your data protection is your responsibility.
A business-grade backup that covers your entire Microsoft 365 environment including email, OneDrive, SharePoint and Teams is the foundation. This backup should be stored independently from your Microsoft 365 tenant so that an issue affecting your tenant does not affect your backups.
Having offline access to critical documents means your team can keep working during a cloud outage even if it is limited. Keeping a local copy of your most important files is a simple precaution that makes a real difference when the cloud is unavailable.
A documented plan for what your team does during a cloud outage prevents panic and wasted time. Who do they contact? What can they work on offline? How do they communicate if Teams and email are both down?
The bottom line
Cloud services are reliable but they are not infallible, and reliability is not the same as data protection. The provider keeps the lights on. Keeping your data safe, recoverable and available when things go wrong is your responsibility.
At Recloud we set up and manage backup solutions that protect your entire Microsoft 365 environment independently from Microsoft's infrastructure. If you are relying on the cloud provider alone to keep your data safe, get in touch and we will show you where the gaps are.