A Guide to Microsoft 365 Backup for Small to Midsize Businesses

Shared Responsibility: Who Protects What

Like most SaaS platforms, Microsoft follows a shared responsibility model. It ensures platform availability and secures the underlying infrastructure, but your organization must protect and recover data from deletion, corruption, and cyberattacks

Customer Responsibility

• Limiting access and maintaining compliance controls
• Managing identity and access with secure tools
• Protecting connected devices from ransomware and other threats
• Configuring APIs, storage, and systems properly
• Writing and deploying applications securely
• Implementing authentication (e.g., MFA) and permissions

Cloud Service Provider's Responsibility

• Securing data centers, hardware, and facilities
• Managing systems that enable cloud functionality
• Providing tools like firewalls and network defenses
• Securely deploying and configuring infrastructure for SaaS apps
• Protecting the software and its underlying code

Learn more about Microsoft’s shared responsibility model.

CrashPlan’s approach aligns with this model—giving you transparent visibility, tested recovery, and audit-ready evidence that demonstrates your control over business data.

Microsoft’s built-in retention policies may not be enough for long-term recovery or compliance. To understand the business risks of relying solely on Microsoft 365, read why small businesses need to back up Microsoft 365.

The Protection Gaps SMBs Need to Know in Microsoft 365

What Microsoft Handles

• Service availability
• Infrastructure uptime
• Platform security

What Microsoft Does Not Handle

• Restoring clean data after a ransomware attack
• Long-term data retention beyond policy limits
• Recovery from cyber or insider deletion

Takeaway:

If Microsoft 365 data is lost, corrupted, or encrypted, your IT team is responsible for recovery—unless you have an independent backup in place.

For most SMB IT leaders, that responsibility lands on a small team with limited time and bandwidth. A dependable, automated backup removes that constant “what if?” worry and replaces it with proof that your data can be restored.

The Real Risks SMBs Face with Microsoft 365

Accidental Deletion

Employees delete emails, files, or folders every day, often without realizing the impact. Once retention windows expire, data is permanently lost.

Examples:

• Deleting a OneDrive folder during cleanup
• Removing a SharePoint library
• Overwriting critical files

Ransomware and Malware Attacks

Cloud data is not immune to ransomware. Microsoft may restore service availability, but will not restore clean versions of your data.

Attackers can:

• Encrypt OneDrive and SharePoint files
• Sync encrypted files across devices
• Spread damage through shared folders

Malicious or Insider Threats

Not all data loss is accidental.

Risks include:

• Disgruntled employees deleting data
• Former employees with lingering access
• Privileged users making destructive changes

Without backups, recovery options are limited or nonexistent.

Phishing and Account Compromise

Not every threat comes from malware. Many begin with a convincing email.

Risks include:

• Stolen credentials leading to unauthorized access
• Attackers deleting or encrypting OneDrive and SharePoint data
• Business email compromise and mailbox rule abuse
• Lateral movement into Teams and shared resources

Many SMBs ask if they truly need an independent backup for Microsoft 365 — the short answer is yes. Explore this further in Do I really need a backup for Microsoft 365?

Key Stats You Shouldn’t Ignore

These numbers point to one reality: relying solely on your SaaS provider isn’t enough protection.

• 1 in 4 phishing attacks in Q1 2025 targeted Microsoft credentials
  (Source: Check Point Research)
• $10.22 million — average cost of a U.S. data breach in 2025
  (Source: IBM Cost of a Data Breach Report 2025)
• 91% of organizations say one hour of downtime costs more than $300,000
  (Source: ITIC 2024 Hourly Downtime Report)
• 0 — the number of true, independent backups Microsoft automatically maintains for your data
  (Source: Microsoft Shared Responsibility Model)

Best Practices for SMB Microsoft 365 Backup

• Back up all users, not just executives. Every employee generates important data. Selective backups create blind spots.
• Include former employee data. Departed users’ files often contain essential operational or legal information.
• Test restores regularly. A backup is only valuable if it can be restored quickly and accurately.
• Apply least-privilege access. Limit backup access to authorized admins to reduce insider risk.
• Automate backups and monitoring. Reduce human error and ensure consistent protection.
• Choose a vendor built for SMB simplicity. Look for cloud-native, easy-to-manage platforms that minimize IT overhead.
• Document recovery procedures. Define who restores data, how, and within what timelines.
• Align with RPO/RTO goals. Choose backup frequency and recovery speed that fit your business tolerance for downtime.

Build recovery confidence into your culture. Schedule periodic restore tests so you and your leadership see tangible proof that data protection is real, repeatable, and not dependent on any one person.

CrashPlan for Microsoft 365

CrashPlan complements Microsoft 365 by delivering simple, reliable, continuous backup for your cloud data with no additional infrastructure to manage.

Simple Setup, IT-Level Control

• Cloud-to-cloud backup—no servers or hardware required
• Automated backups that run in the background
• Centralized admin visibility for backup status and policies

Smart, Cost-Efficient Storage

• Built-in pooled storage across users (50 GB per user included, confirm plan details)
• Deduplication and compression to minimize storage footprint
• Flexible backup policies to prevent storage bloat

Ready for Worst-Case Recovery

• Rapid recovery for Exchange Online, OneDrive, and SharePoint
• Teams data protected through its SharePoint and OneDrive sources
• Designed to recover from accidental deletion, ransomware, or compromise

Efficiency for IT Teams

• Policy-based backups applied consistently across workloads
• Role-based access control for secure delegation
• Notifications and reporting for quick issue resolution
• SSO integration for simplified and secure access
• Indexed search to locate backed-up content for audit or HR needs

Tested restore workflows and detailed reports make it easy to prove readiness during customer audits, insurer reviews, or executive briefings.

Data Security & Compliance

• Encryption in transit and at rest
• Two-factor authentication for admin accounts
• Legal hold to preserve data for compliance or investigation

Ready to protect your Microsoft 365 data? Check out our SMB backup pricing and plan options to get started.

Frequently Asked Questions (FAQ)