This is one of the most common misunderstandings we come across. Microsoft is responsible for making sure the service works. You are responsible for the content within it. That division of responsibility is stated in the agreement, but few have read that part until something has been deleted.
The shared responsibility model, in plain terms
Microsoft guarantees that the platform is available and that its own infrastructure is redundant. If one data center fails, you won’t even notice.
What Microsoft doesn’t do is protect you from yourselves. Deleted emails, overwritten files, a departing user whose account gets wiped, or a compromised account that empties a mailbox — that’s your responsibility, and it isn’t covered by the service simply working as intended.
The recycle bin is not a backup
Deleted items remain for a limited time before they’re permanently gone. That’s enough for mistakes caught the same week. It’s not enough for something discovered during a financial close, a dispute, or an audit months later.
Retention policies can extend the timeframe, but they are settings within the same system. If the account that administers them is lost, the security you thought you had no longer applies.
The four scenarios that actually happen
Someone deletes something by mistake and discovers it too late. The most common, least dramatic scenario—and the one that most often triggers the call to us.
An account is compromised via phishing and used to delete or encrypt content. Protection against this is MFA as a preventive measure, and an independent copy after the fact.
An employee leaves, the account is closed, and it turns out that important information was stored in the person’s OneDrive—often a result of shadow IT, where work is done in tools the organization has no visibility into.
You need to show history in a dispute or audit, and it’s no longer there.
What a complete backup covers
Exchange Online: email, calendars, contacts, and shared mailboxes. SharePoint Online: document libraries, lists, and version history. OneDrive: users’ personal storage, including closed accounts.
Teams: chats, channels, and files, which in practice are stored in SharePoint and OneDrive in the background.
What is often overlooked are closed accounts and shared mailboxes. They contain information that the business needs, but which no single individual is monitoring anymore.
This is how we do it at Savecore
Microsoft 365 backup for businesses protects Exchange, SharePoint, OneDrive, and Teams in our own data centers in Sweden. The copy is stored outside Microsoft’s environment, which is the whole point — it survives both mistakes and compromised accounts. If you need to secure the rest of your environment in the same way, the same approach applies as for backup as a service.
Because the storage takes place in Sweden under Swedish law, the same solution often also resolves the question of storage location and data sovereignty that comes up in procurement processes.
Frequently asked questions about responsibility in Microsoft 365
Isn’t backup included in our Microsoft 365 license?
No. The license provides availability and limited retention, not backup in the true sense. Responsibility for the content lies with you according to the shared responsibility model.
How far back can we restore?
With a separate backup solution, you control the retention period yourself, unlike the platform’s built-in limits.
Does it also cover Teams?
Yes. Teams content is stored in SharePoint and OneDrive in the background and is included in the protection.
Microsoft protects the platform. You are responsible for the content.
We secure Exchange, SharePoint, OneDrive, and Teams in Swedish data centers.