Microsoft secures your infrastructure – but who secures your data? The shared responsibility model of Microsoft 365 is underestimated by many Swiss companies, with potentially serious consequences for data security.
Why Backup?
Shared Responsibility
Microsoft guarantees platform availability and protects against hardware failures and natural disasters. However, protecting your data from accidental deletion, ransomware, malicious insiders, or failed migrations is your responsibility as the customer. This distinction is not well understood by many IT managers and creates a dangerous blind spot in data protection strategies.
Data Loss Scenarios
Deleted emails, SharePoint documents, or Teams data can only be restored within limited retention windows – after that, they are permanently lost. Retention policies are not a backup replacement: they serve compliance purposes, not targeted recovery of individual items. Ransomware attacks can also encrypt cloud data when synchronized clients are compromised.
Compliance
Swiss companies are subject to industry-specific retention obligations (e.g., Swiss Code of Obligations Art. 958f for business records). A dedicated backup ensures these requirements are met regardless of Microsoft's retention settings. Regulated industries such as financial services or healthcare face additional requirements from FINMA and the Federal Data Protection Act.
Backup Options
Native Features
Microsoft offers basic protection through retention policies, litigation hold, and file versioning. These are suitable for compliance scenarios but do not provide granular point-in-time recovery. Microsoft 365 Backup (Preview) extends native capabilities but does not yet cover all workloads comprehensively.
Third-Party Solutions
Specialized backup solutions such as Veeam, AvePoint, or Acronis provide comprehensive protection for Exchange, SharePoint, OneDrive, and Teams. Pay attention to Swiss data residency: backup data should be stored in Swiss data centers or at minimum within the EU. Automated backups with granular recovery capabilities are the industry standard.
Best Practices
Define RPO (Recovery Point Objective) and RTO (Recovery Time Objective) for each workload. Test your recovery processes regularly through simulated restore scenarios. Document your backup strategy as part of your business continuity plan and ensure your solution meets Swiss data protection requirements.
Conclusion
A Microsoft 365 backup is not an optional addition but a business-critical necessity. Swiss companies should take the responsibility gap in the shared responsibility model seriously and implement an appropriate backup strategy without delay.