Microsoft looks after uptime, not your data

The shared responsibility model catches a lot of teams out. What Microsoft protects, what is squarely on you, and the five gaps we find in almost every tenant we inherit.

The answer, up front

The short answer: Microsoft guarantees the service is available. It does not guarantee your data is recoverable. Under the shared responsibility model Microsoft owns the infrastructure, the platform and its uptime; you own your data, your identities, your device configuration and who has access to what.

The recycle bin and retention policies are not a backup. They are a short, configurable grace period, and once it lapses the data is gone. Cloud & Microsoft 365 covers the tenant and identity side, Disaster Recovery covers the backup and restore side Microsoft explicitly leaves to you, and a multi-clinic group’s 365 migration shows both handled together.

The recycle bin is not a backup. It is a short, configurable grace period, and once it lapses the data is gone.

Why this matters now

For most Australian businesses, Microsoft 365 has quietly moved from a back-office concern to a board-level one. The tools people rely on every day now sit across cloud services, personal devices and a supply chain of third parties, and the gaps between them are exactly where problems appear.

The teams that stay ahead are not the ones with the biggest budgets. They are the ones that treat this as an ongoing operating discipline rather than a project that finishes. That shift in mindset is what separates a setup that holds up under pressure from one that only looks fine until the day it does not.

What good looks like

When Microsoft 365 is handled well, it tends to be invisible. The difference shows up in the details rather than the dashboards. A few markers to look for:

• Clear ownership, so there is never a question of whose job a given task is.
• Proactive maintenance and monitoring, so most issues are caught before anyone raises a ticket.
• Documented, tested procedures that a new team member could follow under pressure.
• Regular reporting in plain language, not a wall of metrics that hide the real story.

Where to start

You do not need to fix everything at once. Start with an honest assessment of where the real risk sits, then sequence the work so the highest-impact changes land first. That usually means shoring up the basics, closing the obvious gaps, and building the routine that keeps them closed.

From there, the work compounds. Each improvement makes the next one easier, and the environment gets steadily more resilient without a disruptive overhaul. If you would like a hand mapping that path for your business, we are happy to help.