Practical guide · Data continuity
Service availability and getting your data back are not the same promise.
Microsoft keeps the Microsoft 365 infrastructure available, but fully recovering your own data after a deletion, a mistake, or a malicious act stays a shared responsibility. This guide helps see clearly what is already covered.
The decision to make
This guide helps decide whether your current mechanisms - recycle bin, version history, retention policies - are enough for your situation, or whether a separate backup decision needs to be made.
Microsoft keeps things available, not necessarily fully recoverable
Microsoft 365’s shared responsibility model covers infrastructure, availability, and platform security. Fine-grained recovery of your own data - a folder deleted six months ago, an entire user rebuilt after an incident - remains a question your organization has to ask explicitly.
The recycle bin and version history have a limited window
Deleted items and earlier versions of a file only stay recoverable for a limited time before permanent deletion. A late discovery can arrive after that window has already closed.
- Recovery windows are known to the team, not only the administrator
- A suspicious deletion is handled quickly, not set aside
- Version history is checked rather than assumed to be enough
A retention policy is not a backup
Retention and legal hold exist to preserve content for compliance reasons; they are not designed to quickly restore a complete environment after mass deletion, malicious encryption, or a configuration mistake.
A departure is the riskiest moment
Without an explicit decision, the contents of a mailbox or a OneDrive can become inaccessible or be lost when an account is closed. The departure checklist should include a clear decision about what is transferred, kept, or closed.
Deciding whether third-party backup is needed
Depending on data sensitivity and your organization’s tolerance for loss, a separate backup solution may be justified. This guide helps ask the question; choosing, purchasing, and setting up such a tool remains a separate decision and scope, not something this site implicitly includes.
A simple matrix for assigning the work.
| Situation | Owner | Cadence | Useful evidence |
|---|---|---|---|
| Recent accidental deletion | User + M365 | As soon as found | Item restored or reason documented |
| User departure | Manager + M365 | Before account closure | Transfer or retention decision |
| Retention obligation | Leadership | Periodic review | Confirmed retention policy |
Decision checklist
What should be true before considering this area under control.
- The team knows what Microsoft-managed availability actually covers
- Recycle bin and version history windows are known
- A retention policy exists and is understood, without being confused with backup
- A user’s departure includes a decision about their data
- The need for third-party backup has been assessed at least once
Next step
See where data continuity fits inside the monthly scope.
The service scope spells out what always stays separate. Then use the readiness list to name your organization’s highest-risk data.