Most business owners I talk to have a picture of where their email actually lives.
It's a data center somewhere. Racks, cooling, locked doors, blinking lights. Somebody whose entire job is keeping that building running is keeping your business running.
That part is true. The big cloud providers run those buildings, and they run them well.
Here's the part that surprises people. None of that is a backup of your email.
Running the building is not the same as keeping your copy
The provider's job is to keep the service up. Your job is to get your data back. Those sound like the same thing. They are not.
The difference matters because of how a modern cloud actually works. When you save a file to OneDrive or send an email, several copies of it exist, in more than one data center. That saves you if a server dies or a building floods. That is availability, and it is good engineering.
But those copies are not snapshots you can go back to. They mirror each other in real time. If ransomware encrypts a file, every copy is encrypted within seconds. If someone deletes the wrong folder, every copy agrees with them. A mirror is very good at reproducing exactly what happened. Including the part you are trying to undo.
The clock nobody reads
When you delete something in Microsoft 365, it does not vanish immediately. There is a grace period. The grace period is shorter than most owners assume, and it is set by the vendor, not by you.
Deleted mail items sit in what Microsoft calls the Recoverable Items folder for 14 days by default. An administrator can stretch that to 30 days at most. After that, the item is removed from Exchange Online. Not archived. Removed.
Files follow a similar clock. When you delete a user account, that person's OneDrive has a 30 day retention period, then the data moves to a site collection recycle bin, where it is held for 93 days. At the end of that, it is gone. Getting it back before then takes a PowerShell command, not a right click.
These windows are not industry rumor. They are written down in Microsoft's own documentation, in plain text, on pages anybody can open. If you have been assuming the cloud keeps a copy forever, you are working from different rules than the ones you agreed to.
Why ransomware makes the clock worse
Here is the uncomfortable part. Those recycle bins sit inside the same environment as everything else, reachable with the same username and password your team uses every day.
Federal guidance is blunt about what that means. The CISA #StopRansomware Guide tells organizations to maintain offline backups of critical data, and explains why: many strains of ransomware hunt down accessible backups specifically to delete or encrypt them, so the victim has nothing left to restore.
A recycle bin is an accessible backup. It lives in the same account, behind the same login. That is precisely the kind of copy the guidance is telling you not to rely on.
Three questions worth asking this week
You do not need a technical background to find out where you stand.
- Do we have a copy of our email and cloud files that a stolen password cannot reach? - If our Microsoft 365 account were wiped today, what is the most recent date we could get back to? - When did we last actually restore something from a backup, and did it work?
That third one is the question people skip. A backup that has never been restored is a hope, not a plan.
What "backed up" actually means
An independent copy. Stored outside the system it protects. Captured at a point in time, so you can return to before the mistake instead of only to right now. And held somewhere that the same stolen credentials cannot alter or destroy.
If a copy lives inside the same account, under the same login, protected by the same password, it will not save you from a bad password. That is the whole test, and it takes about five minutes with someone who knows what to look for.
Where to start
Most Upper Peninsula businesses I sit down with are not missing an expensive product. They are missing an answer to one simple question: if all of this disappeared tonight, what would we actually do tomorrow morning?
That is a conversation, not a purchase. Reach out and we will walk through what you have, what it covers, and where the gaps are. If the honest answer is that you are in good shape, we will tell you that too.