Microsoft 365 Keeps the Service Running. Who Keeps Your Data?

Ask a business owner whether their email and files are backed up, and you'll often hear a confident "yes — it's all in Microsoft 365." It's a reasonable assumption. It's also the gap that turns a bad Tuesday into a bad month.

Microsoft 365 and Google Workspace are excellent at one thing: keeping the service available. The servers stay up, the mail flows, the documents open. What they do not promise is to protect your data from you, your staff, or an attacker. That distinction has a name — the shared responsibility model — and most small businesses find out about it on the day they need a restore that isn't there.

What Microsoft actually guarantees

Microsoft's commitment is uptime and infrastructure. If a drive fails in their data center, that's their problem and you'll never notice. But the moment the threat is a deleted mailbox, a ransomware-encrypted SharePoint library, or a departing employee, you're on the hook. Microsoft says as much in its own service agreement, and industry guidance keeps repeating it because the misunderstanding is so common (BleepingComputer). The recycle bin and retention windows built into the product are real, but they're short, easy to misjudge, and were never designed to be your backup.

The five gaps Microsoft won't cover for you

Here's where "it's all in the cloud" quietly fails:

• Accidental and malicious deletion. Someone empties a folder, or a leaving employee clears their mailbox on the way out. Once the short native retention window passes, it's gone. A real backup doesn't have that clock.
• Ransomware in the cloud. Attackers stopped limiting themselves to file servers — they encrypt what's in OneDrive and SharePoint too. If your only copy lives in the same account they just compromised, you don't have a copy.
• Departed-employee data. When you deprovision an account to stop paying for it, the mailbox and files can go with it. Six months later, when you need that person's records for a client or a dispute, "we turned off their license" is not an answer.
• Retention beyond the defaults. If you operate under any compliance or legal-hold requirement, the built-in windows usually fall short of what you're actually required to keep.
• Granular, point-in-time restore. Even when something is technically recoverable, getting back one item, folder, or a specific day's state — without rebuilding everything around it — is exactly what the native tools aren't built to do.

None of these are exotic. They're the ordinary ways businesses actually lose data, and the cloud provider's default answer to all of them is the same: that part is yours.

Google Workspace is the same deal

If you run on Google instead of Microsoft, don't exhale. The model is identical — Google keeps Gmail, Drive, and Calendar running; protecting the contents against deletion, ransomware, and offboarding is your responsibility. The logo changes; the gap doesn't.

What closing the gap actually looks like

The fix isn't complicated, and it isn't a bigger Microsoft plan. It's an independent backup of your cloud data, held separately from the provider, so a problem inside your tenant can't take the backup down with it. Done right, that means your Microsoft 365 and Google Workspace mail, files, and sites are copied somewhere you control; a compromised or corrupted account can be rolled back to a clean point in time; a former employee's data stays recoverable for as long as you need it; and you can restore down to a single item without a fire drill. That's exactly the layer we build in our SaaS and cloud data backup work — the cloud half of a complete backup and cyber-resilience plan.

Key takeaways

• Microsoft 365 and Google Workspace guarantee the service, not the safety of your data.
• The shared-responsibility model puts deletion, ransomware, offboarding, and retention squarely on you.
• Native recycle bins and retention windows are short and were never meant to be a backup.
• Ransomware now targets cloud data directly, so a copy living in the same account isn't a copy.
• An independent, separately-held backup with point-in-time restore is what closes the gap.

How we help

At Amoeba Networks we protect the cloud data that small businesses across the New York metro and the Puget Sound area assume is already covered — adding an independent backup of Microsoft 365 and Google Workspace, testing that a restore actually works, and keeping departed-employee data recoverable instead of deleted with the license.

If you've never confirmed whether your Microsoft 365 or Google data could actually be restored — not just that it's "in the cloud" — that's the fastest question we can answer. Let's take a look.