We tell clients all the time that Microsoft 365 is not a backup. This week, Microsoft made the point for us.
According to a report in The Register on September 28, 2026, Microsoft told a group of nonprofit organizations that some of their Microsoft 365 data had been deleted before its retention period was supposed to end. Microsoft said the deletion happened because of an error, that its attempts to recover the data had failed, and that it could not provide a list of what was lost. Its offer to the affected organizations was help setting up new Microsoft 365 environments.
If you run a nonprofit, a church or any organization that got Microsoft 365 through a grant or discount program, read this one closely. If you run any other kind of business, read it anyway. The lesson applies to everyone.
What happened
Microsoft ended its Microsoft 365 Business Premium grant for nonprofits, and the grant subscriptions were switched off in July 2025. When a Microsoft 365 subscription ends, the data doesn't vanish on day one. There's normally a retention window that gives an organization time to move to a different plan or get its data out.
For some of those nonprofits, that window didn't hold. Their remaining data was deleted early, and Microsoft said it couldn't bring it back. The report doesn't say how many organizations were affected or exactly what went wrong.
Nobody did anything wrong on the customer side. There was no ransomware and no disgruntled employee. The data sat in Microsoft's own cloud, and it was lost because of a mistake on Microsoft's end.
"But Microsoft keeps copies of everything"
This is the most common misunderstanding we hear, and it's understandable. Microsoft runs enormous, redundant data centers. Your email isn't going to disappear because a hard drive fails somewhere in Virginia.
But keeping the service running is a different job from keeping your data recoverable. Microsoft's model is often called shared responsibility: Microsoft keeps the platform up, and you're responsible for your own content. The recycle bins and retention settings built into Microsoft 365 help with everyday mistakes, but they're time-limited, they follow Microsoft's rules, and, as these nonprofits found out, they live inside the same system that just failed.
If your only copy of your email, files and Teams history is inside Microsoft 365, then anything that happens to that tenant happens to your only copy. That includes:
- a license or subscription change that doesn't go the way it should,
- an attacker who gets into an admin account and starts deleting,
- a departing employee who cleans out their mailbox or OneDrive,
- ransomware that syncs encrypted files into OneDrive and SharePoint,
- or, apparently, an error on Microsoft's side.
License changes are a risky moment
One detail in this story deserves attention: the trouble followed a licensing change. Moving between Microsoft 365 plans, ending a grant, switching providers or letting a subscription lapse is exactly when data is most exposed. Timelines are tight, and the people involved are busy with everything else.
If your organization is planning any kind of Microsoft 365 license change, whether that's a grant ending, a move to a different plan or a new provider, treat it like a move, not a checkbox:
- Make sure you have an independent, current backup before anything changes.
- Confirm in writing what happens to the data on the old subscription, and when.
- Check that the new licenses are assigned and working before the old ones are removed.
- Keep that backup until you've confirmed everything came across.
What real protection looks like
The fix isn't complicated, and it doesn't depend on trusting any single company to never make a mistake.
- A separate backup of Microsoft 365. Email, OneDrive, SharePoint and Teams, copied on a schedule to storage outside your Microsoft 365 tenant, so a problem in Microsoft 365 can't reach it.
- Longer retention than the built-in recycle bins. Problems are often discovered weeks or months later.
- Restores you've actually tested. A backup you've never restored from is a hope, not a plan.
- Someone watching it. Backups fail quietly. Somebody needs to check they're running and fix them when they aren't.
That's what our Microsoft 365 backup service does, and it's part of how we protect every client's data and systems.
A note for Houston-area nonprofits and churches
Many of the nonprofits and churches we talk to around Houston run on donated or discounted Microsoft 365, and their budgets are tight. It's natural to assume a free or discounted license comes with the same protection as everything else from Microsoft. This story shows the data needs protecting either way, and that the moment a grant or discount program changes is the moment to double-check.
If you're not sure whether your organization's Microsoft 365 data is backed up anywhere outside Microsoft, or you have a license change coming up, schedule a free discovery call. We'll tell you where you stand, in plain English.