An HR manager deletes a departed employee's account, unaware that the OneDrive attached to it held the only copies of signed contracts. Ninety days later the retention window closes and the files are gone — permanently. When the company calls Microsoft, the answer is polite and final: account lifecycle management is the customer's responsibility.

This is the shared responsibility model working exactly as designed. Microsoft operates the Microsoft 365 platform — datacenters, uptime, patching, infrastructure security — while the customer owns everything that happens to the data inside it: retention, access, protection, and recovery. EU organizations facing GDPR accountability and NIS2 recovery requirements cannot outsource that ownership by assumption.

The misconception this article dismantles is the most expensive one in cloud computing: "it's in Microsoft's cloud, so Microsoft backs it up." It doesn't, and it says so.

What Is the Shared Responsibility Model?

The shared responsibility model is the contractual division of duties between a cloud provider and its customer. For SaaS platforms like Microsoft 365, the provider secures and operates the service; the customer controls and protects the data, identities, and configurations inside it. Microsoft documents this division openly in its shared responsibility guidance: responsibility for "information and data" is always retained by the customer, regardless of the service model.

The division at a glance

Doesn't Microsoft's Replication Protect My Data?

No — replication and backup solve different problems. Microsoft replicates your data across datacenters to survive hardware failure and keep the service available. But replication is faithful by design: delete a file, and the deletion replicates; get hit by ransomware that encrypts SharePoint libraries via a compromised account, and the encrypted versions replicate too. Every replica is equally broken within minutes.

Backup, by contrast, means an independent, point-in-time copy you can restore from before the damage. Native Microsoft 365 tools offer partial help — recycle bins, version history, retention policies — but with hard limits: deleted items windows measured in weeks, no true point-in-time restore across a tenant, and no copy that exists outside the tenant an attacker just compromised. Availability is not recoverability, and Microsoft only promises the first.

What Goes Wrong When the Model Is Misread

The failure modes are mundane and constant. Departed-employee cleanups that silently destroy business records once retention lapses. Accidental bulk deletions synced across devices before anyone notices. Malicious insiders emptying mailboxes on the way out. And ransomware operators who specifically target cloud data because they know most victims have no copy outside the tenant.

The regulatory exposure compounds the operational one. GDPR's accountability principle requires organizations to ensure — and demonstrate — appropriate protection of personal data they control. The NIS2 Directive goes further for in-scope entities, mandating backup management and disaster recovery as explicit risk-management measures. And according to IBM's Cost of a Data Breach Report, the global average breach cost reached USD 4.88 million in 2024 — with unrecoverable data among the strongest cost drivers. Cyber insurers have drawn their conclusion: proof of independent, tested backups is increasingly a condition of coverage.

How to Cover Your Side of the Model: A Five-Step Plan

Why EU Jurisdiction Belongs in the Decision

Where your backup copies live determines which laws reach them. Copies held by US-headquartered hyperscalers remain subject to the US CLOUD Act regardless of datacenter location — a live concern for European organizations with strict sovereignty requirements. Keeping independent backups in EU-owned infrastructure under Dutch or German jurisdiction closes that gap, aligns cleanly with GDPR expectations, and simplifies conversations with auditors. It also adds a structural security benefit: a backup outside the Microsoft ecosystem, with separate credentials and dedicated data security controls, is beyond the reach of whoever compromises your tenant.

Conclusion

The shared responsibility model is not fine print — it is the operating agreement of cloud computing, and it assigns your data's recoverability to you unambiguously. Microsoft will keep the service running through almost anything; it will also faithfully replicate every deletion, encryption, and mistake your tenant produces. Independent, immutable, EU-hosted backups with tested restores are how an organization actually holds up its side. If you'd like to check where your current setup leaves gaps against the model, we're happy to map it with you.

Frequently Asked Questions