Microsoft 365 Backup for Burlington Organizations

Microsoft's service agreement is explicit that customers are responsible for the recoverability of their own data. Native retention and version history exist to support the platform's operation, not to serve as an organizational backup.

Native retention policies, litigation hold, and the recycle bin have defined limits and specific purposes. A malicious insider, a compromised account, or an accidental bulk deletion can permanently remove data faster than a retention policy is designed to catch, and retention settings themselves can be altered by an account with sufficient privilege — including a compromised one.

Independent backup takes a copy of Microsoft 365 data outside the tenant, on a schedule and retention period the organization controls rather than one set by licence tier or default policy. That copy exists whether or not the tenant's own settings are functioning as intended.

This matters directly for ransomware and business email compromise scenarios, where an attacker with administrative access has both the motive and the means to alter retention settings before or during an attack.