"Microsoft 365 is a powerful productivity platform, but it is not designed or intended to be a complete data protection solution," wrote Andy Kerr, Senior Manager, Solutions Marketing at Acronis.
Shared responsibility model: Microsoft covers infrastructure, customers cover data
Andy Kerr’s piece underscores a clear division in Microsoft 365’s operating model: Microsoft is responsible for service availability and infrastructure security, while data protection — including backup and recovery — remains the customer’s responsibility. The article states this arrangement explicitly and frames it as the root cause of a series of practical gaps organizations face when defending business data stored in Microsoft 365.
Ransomware and malicious data loss can outpace native recovery
The article argues that Microsoft 365 is not designed to fully protect against ransomware and malicious data loss. It notes that encrypted or deleted files can sync across accounts, and that native features such as versioning and recycle bins provide only limited recovery. According to the source, attackers can corrupt multiple versions or remain undetected long enough to render native recovery points unusable. The author recommends immutable storage, AI-based ransomware detection, and verified clean recovery points as solutions to ensure safe restoration — features Acronis says it provides through the Acronis Cyber Platform.
Retention policies fall short for long-term compliance
Kerr writes that Microsoft 365’s retention policies are primarily designed for basic governance and that they can be too rigid or insufficiently granular for many regulatory regimes. The piece cites healthcare, finance and legal as examples of sectors that may require years or decades of retention along with auditability — requirements the article contends Microsoft’s native retention controls may not meet. It emphasizes that retention policies are not a substitute for full backups and recommends independent long‑term storage with customizable retention to satisfy compliance and recovery needs.
Granular recovery across Exchange, SharePoint, Teams and OneDrive is limited
The article highlights practical recovery pain points: organizations frequently need to restore specific emails, files, or user items rather than whole environments, yet Microsoft’s native tools can require complex workflows or full-site restores to retrieve those small items. Kerr suggests that this inefficiency increases downtime and IT overhead, and points to third-party offerings — specifically Acronis Cyber Platform — as providing centralized management and fast, item-level recovery across Exchange, SharePoint, Teams and OneDrive.
Phishing and insider threats expose data beyond Microsoft safeguards
Kerr argues that phishing and insider threats create data-loss scenarios Microsoft 365 is not intended to fully prevent. Once an account is compromised, attackers can delete, exfiltrate, or alter data within legitimate sessions; insiders can cause accidental or malicious loss. The article says Microsoft’s native tools provide only limited threat prevention and that recovery after incidents can be manual and fragmented. It recommends combining backup with cybersecurity capabilities so that clean data restoration becomes part of incident response.
What this means for MSPs, IT teams, and regulated enterprises
- Managed service providers (MSPs): The piece calls out MSPs explicitly, arguing that native options are not optimized for multi-tenant management or cost-efficient scaling and that a per-seat pricing model with centralized administration can simplify predictable billing and operations across customers.
- IT and security teams: Kerr frames the problem as operational — complex recovery workflows, uncertainty over which file versions are safe, and the need for immutable, verifiable recovery points increase downtime and workload for IT teams.
- Regulated enterprises (healthcare, finance, legal): The article warns these organizations to watch for retention and auditability gaps in native retention policies and to consider independent long-term storage and flexible retention to meet industry-specific obligations.
In sum, the article presents a single, consistent argument: Microsoft 365 provides platform availability and infrastructure security, but it does not replace dedicated backup, long-term retention, or integrated backup-plus-cybersecurity capabilities. The author recommends third‑party solutions — citing Acronis Cyber Platform — for immutable backups, AI-based ransomware detection, granular recovery, and cost‑efficient scaling for MSPs and larger organizations.
Read the original story: https://www.bleepingcomputer.com/news/security/5-reasons-microsoft-365-backup-isnt-enough-for-business-data-protection/
