In short
The Microsoft 365 shared responsibility model splits security duties between Microsoft and you. Microsoft is responsible for the physical datacentres, network, hosts and platform. You keep responsibility for your data, identities, access management and configuration. In Microsoft's words, for all cloud deployment types, you own your data and identities, so recovering deleted or encrypted data is yours to plan for.
Get a quote for Microsoft 365 backup
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What the shared responsibility model says
Microsoft publishes its shared responsibility model on Microsoft Learn. It describes how security tasks are divided between Microsoft and the customer for each type of cloud service, and Microsoft 365 is one of its named examples of software as a service (SaaS). In SaaS, Microsoft takes on more than in any other model: it runs the buildings, the hardware, the network and the operating systems the service runs on.
One sentence sits above all the detail: "For all cloud deployment types, you own your data and identities." Microsoft goes on to say that you are responsible for protecting the security of your data and identities, and of the cloud components you control.
Microsoft notes that the article uses "responsibility" in a governance sense, as illustrative guidance about who is expected to configure, operate and monitor each control, and that it does not change the terms of your agreement with Microsoft. It is still the clearest statement of how Microsoft sees the split. For the general version that applies to all cloud services, see the shared responsibility model on our Cloud Security site.
Who is responsible for what in Microsoft 365
This is Microsoft's responsibility matrix for SaaS services such as Microsoft 365:
| Responsibility area | Who is responsible in SaaS |
|---|---|
| Customer data | Customer |
| Configurations and settings | Customer |
| Identities and users | Customer |
| Client devices | Shared |
| Applications | Shared |
| Network controls | Microsoft |
| Operating system | Microsoft |
| Physical hosts | Microsoft |
| Physical network | Microsoft |
| Physical datacenter | Microsoft |
Microsoft also lists four responsibilities you keep whatever type of cloud service you use:
- Data: classification, protection, encryption decisions and compliance with data governance requirements
- Endpoints: protecting the laptops, desktops and mobile devices that access your cloud services
- Accounts: creating, managing and removing user access
- Access management: role-based access control, multifactor authentication and Conditional Access policies
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
What Microsoft does protect
Microsoft's side of the model is substantial. Exchange Online, SharePoint and OneDrive keep physically redundant, replicated copies of your data and can fail over between them without you doing anything, so a hardware fault or a datacentre problem does not cost you your mail or files. Microsoft also gives you built-in safety nets: recycle bins, deleted item retention, version history, Files Restore and retention policies.
The limit is that these are designed for the service, not for your history. Microsoft's own Microsoft 365 Backup FAQ explains that a disaster recovery copy maintains the current state of content, not historical versions from earlier points in time. If the current state is the problem, because something was deleted, overwritten or encrypted, the replica faithfully holds the problem too. The safety nets help for a while, but each has a time limit, set out in our Microsoft 365 recycle bin guide.
What it means for deleted, overwritten or encrypted data
Because your data, accounts and configuration are your responsibility, these everyday incidents are yours to recover from:
- Accidental deletion: a user deletes a folder of client files or a mailbox folder and nobody notices until after the recycle bin or deleted item retention period has passed
- Leavers: a user's licence is removed or their account deleted, and their mailbox and OneDrive are removed once Microsoft's grace periods end
- Ransomware and bad syncs: an infected laptop syncs encrypted files into OneDrive or SharePoint, replacing good versions
- Compromised accounts: an attacker who takes over an account, or an admin account, deletes or alters data, or changes retention settings
- Configuration mistakes: a retention policy set to delete rather than retain, or a site removed by mistake
- Identity changes: users, groups or Conditional Access policies changed or removed in Entra ID
Microsoft's tools can undo some of these if you act quickly. A separate backup is what lets you recover from all of them, at any point you need, without depending on how fast someone noticed. Our Microsoft 365 backup vs retention guide explains why retention features do not fill that role.
Is Microsoft 365 backup the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Has Microsoft's position changed?
Microsoft now sells its own Microsoft 365 Backup service, and some people take that as a sign the model has changed. Microsoft answers the question directly in its Microsoft 365 Backup FAQ. Asked whether its stance on shared responsibility for data protection has changed, it says: "No, we still have the same point of view, but are now offering more tools to help organizations achieve those goals and responsibilities."
In other words, Microsoft 365 Backup is a tool you can choose to buy to meet your side of the model, alongside the third-party platforms that do the same job. It is not Microsoft taking over the responsibility. We explain how it works on our Microsoft 365 Backup Storage page.
Do you need to back up Office 365?
Office 365 and Microsoft 365 are the same service family, and the same model applies to both. If losing a mailbox, a SharePoint site or a leaver's OneDrive would cause you a problem, or if a customer, insurer or regulator expects you to show you can recover data, then yes: you need a copy you control and can restore from.
The practical questions are which workloads to protect, how long to keep the data, where it should live and who should be able to restore it. Microsoft 365 backup best practices covers those decisions. Our home page on Microsoft 365 backup solutions sets out the five platforms we supply and Microsoft's own option, and we help you choose between them.
Contact us to check how your tenant measures up against your side of the model.
How Forever Systems helps with Microsoft 365 backup
We are an independent UK IT and cyber security provider. We supply more than one Microsoft 365 backup product, so we can recommend what fits your tenant, your retention needs and your budget rather than one vendor's answer to everything.
- Review what you have: we look at your Microsoft 365 licences, retention policies and any existing backup before suggesting anything new
- Help you choose: we compare the backup products we supply against the workloads you need covered, such as Exchange Online, OneDrive, SharePoint, Teams and Entra ID
- Set-up and onboarding: we can help connect the backup service to your tenant and agree what is protected and how long copies are kept
- Restore testing: we can help you plan and run test restores so you know how recovery works before you need it
- Licensing in one place: backup licences alongside your Microsoft 365 subscriptions, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Contact us to talk it through.
Frequently asked questions
What is the shared responsibility model in Microsoft 365?
It is Microsoft's description of how security duties are divided in its cloud services. For SaaS such as Microsoft 365, Microsoft is responsible for the physical datacentres, network, hosts, operating systems and network controls, the customer is responsible for their data, identities and users, and configurations and settings, and client devices and applications are shared.
Is Microsoft responsible for backing up my Microsoft 365 data?
Microsoft keeps replicated copies so the service stays available, and offers time-limited recovery features and an optional paid backup service. Under the shared responsibility model, protecting and recovering your data remains your responsibility, so you decide whether and how to back it up.
Does Microsoft 365 Backup change the shared responsibility model?
No. Microsoft's Microsoft 365 Backup FAQ says its point of view has not changed, and that it is offering more tools to help organisations meet their responsibilities. Microsoft 365 Backup is one of those tools; third-party backup platforms are another.
What responsibilities do customers keep in every cloud model?
Microsoft lists four areas: your data, your endpoints (the devices that access the service), your accounts, and access management such as multifactor authentication and Conditional Access policies.
Doesn't the Microsoft Services Agreement tell you to back up?
The Microsoft Services Agreement advises regular back-up copies of your content, but it covers Microsoft's consumer services, not business Microsoft 365 subscriptions, which are governed by Microsoft's business terms. For business plans, the shared responsibility model is the more relevant reference.
Still have a question about Microsoft 365 backup?
Ask us and a member of our team will reply by email.
More Microsoft 365 backup guides
Microsoft 365 BackupMicrosoft's own backup for OneDrive, SharePoint and Exchange, explained.Best practicesA practical checklist for Microsoft 365 backup, aligned with NCSC guidance.ProvidersThe five Microsoft 365 backup platforms we supply, and how we choose one with you.