Microsoft doesn't back up your data by default. And when you turn it on, the backup lives inside the tenant it's protecting.
That's fine until the tenant is the problem. A compromised admin, a lapsed subscription, or a deleted tenant reaches the backup too. We tell you exactly where your recovery breaks, before the day you need it.
Microsoft keeps the platform online. Your data is your problem.
Microsoft's own agreement runs on a shared responsibility model. Native features — the Recycle Bin, retention policies, Litigation Hold — were built for short-term recovery and legal preservation, not backup and point-in-time restore.
The infrastructure
Uptime, physical security, and replication across their data centers. Microsoft protects the service. You define the recovery outcome.
The data
Recovery from deletion, ransomware, account compromise, departing employees, and corruption. Your organization decides what has to survive those events, and configures the platform accordingly.
Native retention is not backup. The gap stays invisible right up until the moment you try to recover something and can't.
The losses native tools won't save you from
These aren't edge cases. They're the most common ways organizations lose Microsoft 365 data — and in each one, the native safety net runs out.
Ransomware
Encrypted files sync straight to the cloud. Whether you recover cleanly depends on what was configured before the incident, not after.
Departing Employees
Offboarding behaves differently in Exchange than in OneDrive, and license removal is not account deletion. One bad offboarding workflow turns recoverable data into permanently deleted data.
Malicious Insiders
A disgruntled employee deletes records before walking out — the single most damaging real-world scenario.
Account Compromise
An attacker mass-deletes mail and files, then empties the Recycle Bin and recovery folders behind them.
The Teams Blind Spot
Files, messages, and recordings land in different services with different recovery paths. Microsoft's own backup service does not cover Teams chat at all. Most have never mapped it.
Compliance Gaps
Purview can retain content for years or indefinitely. Whether it does depends on licensing, scope, and policy precedence. "We thought it was covered" is not a defense.
The Microsoft 365 Data Protection Assessment
A fixed-fee, time-boxed review of your true recovery posture — led by a Commvault Master-certified architect. No products to sell you. Just a clear picture of where you stand and what to do about it.
Recovery posture review across Exchange, SharePoint, OneDrive, and Teams.
Risk-ranked gap map tied to the scenarios that actually cause data loss.
RPO / RTO evaluation — what you can recover, and how fast.
Compliance & retention check against your obligations.
Executive one-pager your leadership or board can act on.
Vendor-neutral remediation roadmap — prioritized, not pitched.
- ✓Posture snapshot across all four workloads
- ✓Top-risk findings summary
- ✓Go / no-go recommendation
- ✓~1 week turnaround
- ✓Everything in Rapid Review
- ✓Full gap analysis & risk register
- ✓Executive one-pager + technical findings
- ✓Prioritized remediation roadmap
The people you'd want in the room when it goes wrong
Years in data protection
Led by a Commvault Master-certified architect who has spent a career on backup, recovery, and resilience — not a generalist reading a checklist.
Products we're selling
We're vendor-neutral. Our recommendation is what's right for your environment, not whatever we resell. The findings are the deliverable.
Built for the mid-market
We work with private-equity-backed portfolio companies. We speak to operators and boards in the language of risk, not just IT.
Not ready to talk? Score your own exposure.
Get the Microsoft 365 Backup Gap Checklist — a three-page, 12-point self-assessment. Count your blank boxes and you'll know in five minutes whether your data is defensible or unprotected.
No spam. We send you the checklist, plus our newsletter if you opt in.
Questions you're probably asking
Isn't Microsoft 365 already backed up? +
Microsoft guarantees the platform's availability and replicates data across its own data centers, which protects against their hardware failing. Microsoft now sells a backup service, but it is a paid add-on you have to turn on, it does not cover every workload, and it stores the backup inside the same tenant it protects. Protecting your data from deletion, ransomware, malicious insiders, and account compromise is your responsibility under Microsoft's shared responsibility model, and it's the gap we assess.
We already have retention policies and Litigation Hold. Aren't we covered? +
Those are real tools, but they were designed for legal preservation and short-term recovery, not operational restore. They are license-dependent, can be misconfigured or disabled, and retrieving from them at scale is a search and export exercise rather than a restore. We test whether they'd actually hold up in the scenarios that cause real loss.
Are you trying to sell us a backup product? +
No. The assessment is the product. We're vendor-neutral, so our remediation recommendation reflects what fits your environment and budget — not a reseller agreement. If you choose to act on it, we can help you do that, but the findings stand on their own.
How long does it take? +
The Rapid Review is roughly a week. The Full Assessment depends on the size and complexity of your tenant, but it's deliberately time-boxed and fixed-fee — you'll know the scope and the cost before we start. No open-ended hourly surprises.
What if we find out we're seriously exposed? +
Then you'll have found out on a normal Tuesday instead of during an incident — which is the entire point. You'll get a prioritized roadmap you can act on in stages, sized to your risk and budget.
Find the gap before it finds you.
A fixed-fee assessment. A clear answer. Book a short scoping call and we'll confirm the right tier for your environment.
Book your assessment →This page is informational and does not constitute a formal security audit or legal advice.