A common conversation when a Houston small business switches to us:
"Don't worry about backups — everything's in Microsoft 365 now."
And then, weeks or months later, something goes wrong. A departing employee's mailbox gets purged. A SharePoint folder is accidentally deleted and not noticed for 45 days. A ransomware infection on a laptop syncs encrypted versions of files up to OneDrive. The owner reaches out to Microsoft support, fully expecting a recovery. The answer is some version of: sorry, that's outside our retention window.
The misunderstanding is everywhere. Let's walk through what Microsoft actually does, what it doesn't, and what real M365 backup looks like for a Houston small business.
Microsoft's shared-responsibility model in plain English
Microsoft is responsible for keeping the platform online: the servers, the data centers, the software, the security of their infrastructure. They guarantee uptime, not data recovery. They publish this clearly — it just doesn't get read.
You are responsible for your data. Deletions, accidental edits, ransomware overwrites, malicious insider activity, retention beyond Microsoft's default windows — all yours.
The defaults are short. Deleted items in Exchange are retained for 14 days by default (extendable to 30). Deleted OneDrive and SharePoint items go to a recycle bin for 93 days and then they're gone. Teams chats have their own rules. None of this is "backup" in any meaningful business sense.
Three Houston scenarios where SMBs have lost data
Scenario 1: the departing controller. A 30-person Houston firm offboards their accounting manager. Per standard process, they remove her license. Microsoft purges her mailbox 30 days later, per their own rules. Two months after that, a state tax audit asks for emails she sent. They're gone. The recovery quote from a third-party forensics firm is five figures — and it might not work.
Scenario 2: the ransomware sync. A laptop in a Houston small business gets hit by ransomware. Files on the local drive are encrypted. The OneDrive sync client dutifully syncs the encrypted versions up to the cloud, overwriting the originals. Version history helps for files modified in the last 30 days. For everything older, it's gone.
Scenario 3: the SharePoint cleanup. An employee deletes a SharePoint folder thinking it was obsolete. Nobody notices for 100 days. By the time someone asks "where did the 2024 customer files go?", the 93-day recycle bin window has closed.
In every one of these cases, real M365 backup would have made the recovery a 5-minute ticket.
What real M365 backup actually covers
A proper backup tool for Microsoft 365 runs daily (or more), keeps point-in-time copies for as long as you set (typically 1+ year), and stores them outside your M365 tenant. That last part matters: if your tenant is compromised, the attacker can't reach your backups.
What's protected:
- Exchange Online mailboxes (every email, every appointment, every contact)
- OneDrive for Business files
- SharePoint document libraries and lists
- Teams chats, channels, and files
Recovery is granular. You can restore a single email, a single file, a single folder, or an entire user's mailbox to a specific point in time.
Cost vs. data-loss math
Our Microsoft 365 Backup Service for Houston small businesses runs a few dollars per user per month. For a 25-person firm, that's roughly the cost of one team lunch.
The cost of not having it shows up in:
- Lost business time when someone has to recreate work from scratch
- Legal exposure when records that should have been retained are gone
- Customer trust when project data evaporates
- Forensics fees when you try to recover from third parties
The math isn't subtle.
What to do this week
If you're a Houston small business on Microsoft 365 and you don't have a third-party backup of your tenant, you have a single-point-of-failure for every email and file your company has produced this year. Three options:
- Verify with your current IT provider that M365 backup is in place (ask for the most recent restore test result — not just "yes we have backup").
- Spin up your own using a tool like Datto, Acronis, or Veeam (typically $3–6 per user/month).
- Book a free 15-minute discovery call with us and we'll get you set up as part of managed services.
Aspendora Technologies provides cybersecurity, managed IT, and data backup and recovery to Houston-area small businesses since 2010.