Different controls solve different problems
Microsoft operates a resilient cloud platform. Retention policies and recycle bins can preserve information for defined periods. Backup adds a separately managed recovery copy, a different retention model and a service owner responsible for restores.
Common small business risks
Accidental deletion, compromised administrator accounts, malicious deletion, misconfigured retention and legal or operational recovery requirements can expose gaps between “the cloud is resilient” and “we can restore exactly what the business needs”.
Questions to ask
- Which Microsoft 365 workloads are protected?
- How long is each type of data retained?
- Can a single item, folder, mailbox or site be restored?
- When was the last successful restore test?
- Who is authorised to request and approve recovery?
The right answer depends on business impact, regulatory obligations and contractual expectations, not on a generic statement that every organisation must buy the same product.