Microsoft 365 Cloud Backup & Recovery Services for Businesses in London

Not entirely. Microsoft's Shared Responsibility Model is exactly that: shared. Some responsibilities always remain with the customer, regardless of the service type you are using. As Microsoft's own documentation makes clear, you are always responsible for:

• Data: including data classification, data protection, encryption decisions and compliance with data governance requirements
• Endpoints: protecting the client devices and endpoints that access your cloud services
• Accounts: managing user access, including creating, managing and removing users
• Access management: implementing access controls, MFA and conditional access policies

Source: Microsoft. A third-party backup solution fills the gap this model leaves. If your data is lost, corrupted or deleted through cyber crime, human error or any other cause, Microsoft will not recover it for you. An independent backup will.

A common misconception is that Microsoft 365 includes a full backup of your data. It doesn’t. Microsoft is responsible for the platform, but your data remains your responsibility.

Current best practice is to:

• Use a separate third-party backup to protect against ransomware and data loss
• Define how far back and how quickly you need to restore data
• Test recovery regularly to make sure it actually works

The standard today isn’t just being in the cloud – it’s being able to recover your data quickly and confidently when something goes wrong.

We use a third-party backup solution with the ability to enable Immutable Storage, which means backup data cannot be altered, deleted or encrypted, even if ransomware gains access to your environment.

This creates a clean, untouchable recovery point, allowing your data to be restored to a known-good state if files are encrypted or compromised. Immutable Storage can be enabled where required, either as part of your wider security strategy or to meet specific compliance or regulatory requirements.

Yes, in most cases. Our backup solution supports granular recovery, meaning you are not faced with the choice of restoring everything or nothing. If a single email has been deleted, a Teams file has gone missing or a specific version of a document needs to be recovered, we can target that restore specifically.

There are occasional exceptions depending on how and when the data was deleted, and we will always be upfront if something is not recoverable and explain why. For the vast majority of everyday recovery scenarios, granular restore is exactly what we would do.

They serve very different purposes and are not interchangeable.

A backup solution creates independent copies of your entire M365 environment, including data, files, emails and Teams chats, that can be restored if something is lost, deleted, encrypted or destroyed. It is your safety net in a disaster scenario.

Retention policies are a compliance tool. They define how long content must be kept or must be deleted, helping you meet regulatory requirements around data governance.

There are two settings: retain content (preventing permanent deletion and keeping it available for eDiscovery) and delete content (permanently removing it from your organisation). A retention policy can prevent content from being permanently deleted, but it is not a backup. It does not protect you from ransomware, provide a point-in-time snapshot to restore from or replace the ability to recover your environment after an incident. Both are valuable in a well-governed M365 environment, but they serve different purposes. 

A well-managed backup solution makes Right to Erasure requests easier to handle, not harder. It gives you the visibility and control needed to respond appropriately. Specifically, it helps by:

• Identifying where personal data exists across backups, archives and historical snapshots
• Enabling selective deletion or expiry rather than retaining data indefinitely
• Applying defined retention policies so personal data is not kept longer than necessary
• Preventing deleted data from being inadvertently restored during a recovery operation
• Maintaining audit trails that demonstrate erasure requests have been actioned correctly
• Supporting legal and regulatory exceptions where certain data must be retained for defined purposes even when an erasure request has been made