Microsoft Secures the Cloud. You Secure What’s In It.

Under the Microsoft 365 shared responsibility model, Microsoft secures the platform and you secure what sits inside it. Your data, your user accounts, and your tenant settings stay yours. So does backup.

Microsoft will keep the servers running. That is a genuine commitment, financially backed, and better at it than any server closet in Rockland will ever be. What Microsoft will not do is notice that a departing employee walked out with the client list, or that a mailbox rule has been quietly copying invoices to an outside address since March.

Two different jobs. Only one of them got signed for.

Most owners have never seen the split written down, which is fair, because nobody hands it to you at signup. It is published, though. Microsoft puts it in a table, and once you have looked at the table it gets hard to keep believing that moving to Microsoft 365 moved the security problem somewhere else along with the mail.

The Line Microsoft Draws

Microsoft 365 is software as a service, so it sits in the far-right column of Microsoft’s own shared responsibility documentation. Here is that column, reproduced rather than paraphrased into something friendlier. No commentary yet.

Read down that second column and notice where the word “You” stops. Everything Microsoft owns is infrastructure. Plumbing, mostly. Cooling, cabling, hypervisors, the operating systems under the services, the network between them. Real work, enormous scale, and none of it is the thing that goes wrong at a twenty-person insurance agency in Nanuet.

What goes wrong at that agency lives in the top three rows.

The Row Nobody Reads

Customer data gets the attention. Everybody nods along at “you own your data,” agrees it sounds reasonable, and moves on without changing anything.

The row underneath it is the one that costs money. Configurations and settings sit with the customer in every single column of Microsoft’s table, from on-premises all the way through SaaS. There is no deployment model where Microsoft configures your tenant for you. Not one.

So the sharing permission somebody set to “Anyone with the link” three years ago is yours. The legacy authentication protocol nobody disabled is yours. Conditional access rules that were never written, guest accounts from a project that ended in 2023, the global admin account still tied to a former bookkeeper’s personal phone for its second factor, all yours. Microsoft supplies the switches. Nobody at Microsoft flips them on your behalf, and nobody there will call you when one is in the wrong position.

This is not a niche observation. CISA built an entire program around it. Their Secure Cloud Business Applications project came out of federal agencies getting compromised through SaaS tenants that were not broken, just badly configured. CISA now publishes secure configuration baselines for Microsoft 365 and recommends every organization review them, not just federal ones. A government agency does not write a configuration baseline for a product that configures itself.

How Long Your Deleted Data Sticks Around

Here is where the conversation usually turns, because most people assume the cloud remembers everything forever. It does not. Microsoft publishes the exact windows, and they are shorter than that.

• A permanently deleted email sits in the Recoverable Items folder for 14 days by default. You can raise that to 30. Thirty is the ceiling.
• Deleted files and deleted SharePoint sites get 93 days, counted across the site and site-collection recycle bins together rather than 93 in each.
• Delete a user account and their OneDrive is kept for 30 days by default before it moves to the recycle bin for its own 93.
• Empty the second-stage recycle bin by hand and the items are purged immediately. No window at all.

Then there is the sentence that ends the argument. Microsoft holds an internal backup of SharePoint content for 14 days past actual deletion so support can run a point-in-time restore, and its documentation finishes the thought without softening it: “After this 14 day period, Microsoft no longer retains the data and it isn’t recoverable.”

Not recoverable by escalation. Not recoverable by paying more. Gone.

Ninety-three days sounds generous right up until you map it against how businesses discover problems. A quarterly review that finds a folder missing. An auditor asking for correspondence from last spring. The departed controller whose mailbox got cleaned up in week two and whose emails somebody needs in month six. Ransomware that encrypts a synced folder on a Tuesday and rides that sync straight up into SharePoint, where every clean version quietly ages toward the same expiry date as the encrypted ones. Same clock. No exceptions.

Microsoft Sells Backup Separately, Which Should Settle It

If the base subscription already protected your data, Microsoft would not be selling you protection for it.

Microsoft 365 Backup is a real product covering SharePoint, OneDrive, and Exchange Online. It bills pay-as-you-go at 15 cents per gigabyte per month, restores included, with recovery windows you set at three months, six months, one year, or two years. It is a decent product and my team has no argument with it.

The point is that it exists and carries its own meter. Vendors do not build, staff, and bill a backup platform to solve a problem their base service already handles. That line item is Microsoft telling you where the line is, in the clearest language a company ever uses, which is pricing. Follow the invoice.

The uptime commitment says the same thing from the other direction. Microsoft’s service level agreement is 99.9% availability, financially backed, and the remedy when it is missed is a service credit against your monthly fee. That is a promise the service will be reachable. Nobody promised the contents would be there.

The Four Things That Stay Yours No Matter What

Microsoft names them directly, calling them the responsibilities you always retain regardless of deployment type. No asterisks.

Data. Classification, protection, encryption choices, and the decision about what a copy outside the tenant is worth to you. That last one is the whole backup conversation compressed into a sentence.

Endpoints. The laptop is where the credential gets stolen. Microsoft’s table lists client devices as shared for SaaS, which sounds better than it is, because the shared half is tooling and the other half is somebody making sure that tooling is on the machine your bookkeeper takes home on Fridays.

Accounts. Go count the enabled accounts in your tenant, then count the people who currently work for you. Do those two numbers match? Creating accounts is the easy half and everyone keeps up with it. Removal is the half that rots, quietly, for years.

Access management. Role-based access control, multifactor authentication, and conditional access. Microsoft ships all three with the license you already pay for. Whether any of them are switched on is a question about your organization, not Microsoft’s, and we wrote separately about why multifactor authentication on its own stopped being enough.

What Ownership Looks Like in a 30-Person Office

Nothing above requires a security department. It requires somebody owning four things instead of assuming a vendor owns them.

For a company of 5 to 60 people it comes down to four. A tenant configuration review measured against a published baseline. Backup that sits outside the subscription and covers Exchange and SharePoint, with a retention window set to outlive how long you take to notice something is missing. An offboarding checklist somebody runs on the day a person leaves rather than the following quarter. Conditional access rules written down where the next person can find them. None of it is exotic. None of it is expensive.

VJNetworks has run Microsoft environments for businesses across Rockland, Westchester, and Bergen for over 20 years, and the tenants that get us called in are almost never the ones with a Microsoft problem. They are the ones where the four customer-side rows went unowned for a few years and nobody noticed, because unowned settings do not generate alerts. Nothing ever tells you.

The backup piece is the one worth doing first, and it is separate from your subscription on purpose. Our backup and disaster recovery service covers Microsoft 365 data specifically, alongside servers and endpoints, and the retention window is set against how long it takes you to find out something is missing rather than against Microsoft’s 93 days. If you are earlier in the process and still planning the move itself, the mechanics are in our walkthrough of a Microsoft 365 migration, and the sanctioned-app side of the tenant is covered in the piece on shadow IT.

Where Owners Push Back on This