Summary
- Microsoft’s shared responsibility model means the company keeps its services running after an attack but does not restore customer data to a known-good point — that obligation sits with the subscriber.
- Microsoft Entra ID has become a primary attack vector; compromised credentials give attackers quiet access to mailboxes, OneDrive, SharePoint, and Teams before ransomware is ever deployed.
- Hybrid environments — spanning on-premises, SaaS, and cloud IaaS/PaaS — are frequently protected unevenly, leaving recoverability gaps that are poorly understood until a crisis hits.
- Independent, immutable, cloud-to-cloud backups stored outside the primary Microsoft tenant are increasingly required by cyber insurers and compliance frameworks.
- Restoring Microsoft 365 and Entra ID in a coordinated single workflow — identity before data — is critical to avoiding extended downtime after an incident.
The assumption that costs organisations dearly
A common position among IT teams and their executives is that Microsoft’s native capabilities provide adequate protection against data loss following a cyberattack. That position is wrong, and the consequences of holding it can be severe. Microsoft operates on the same shared responsibility model as other major SaaS providers: the vendor ensures service availability, while the customer remains accountable for the data held within that service. As Brent Torre, GM of cyber resilience at Kaseya, explains: “Microsoft is clear that whether it’s a SaaS application like Microsoft 365, a platform application like SQL Server, or even VMs running in Azure, the customer is always responsible for the information that’s in that service, as well as devices, accounts and identities.”
What Microsoft’s native tools actually do
Microsoft’s built-in retention and recovery features address a specific and limited set of problems: short-term accidental deletion and certain aspects of data governance. They are not designed as a backup solution and will not protect against ransomware or enable recovery from one. Torre is direct on the point: “If you get compromised and the attacker starts deleting data, Microsoft has no responsibility for that.” The gap between service availability — which Microsoft does guarantee — and true cyber recovery is one that organisations must plan to close on their own terms, before an incident rather than during one.
Three forces widening the exposure
The sources identify three structural factors that have enlarged this risk over recent years. The first is the shift in attacker technique. Modern ransomware campaigns increasingly begin with identity compromise rather than technical exploitation. Credential theft, phishing, social engineering, and AI-powered credential-stuffing attacks against millions of leaked username and password pairs have made identity the primary attack surface. Once an attacker gains access to Entra ID with stolen credentials — often without triggering alerts — they have quiet access to the breadth of the Microsoft environment at their discretion.
The second factor is the uneven protection that accompanies hybrid infrastructure. Organisations routinely spread workloads across on-premises systems, SaaS applications, and IaaS or PaaS environments, yet rarely apply consistent backup and recovery standards across all of them. Data may be replicated across locations without any clear understanding of whether each copy is actually recoverable following a breach. The ‘as a service’ model introduces convenience but also introduces fragility when ransomware targets the tenant.
The third pressure is regulatory. Multiple compliance frameworks now mandate cyber resilience, correct backup procedures, and demonstrable recovery capability. Many organisations are not well positioned to meet these obligations, and a ransomware event has a way of making that gap visible at the worst possible moment — simultaneously to regulators, insurers, customers, and the board.
What sound recovery architecture looks like
The approach that addresses these risks combines independence, immutability, and coordinated restoration. Backup copies should be held outside the primary Microsoft tenant — in a third-party data centre — so that a compromised production environment cannot take the recovery point down with it. Torre notes that some organisations find it faster to stand up a new tenant shell and rebuild it than to fight for access to a compromised one. Whatever the approach, restoration of Microsoft 365 and Entra ID should occur in a single coordinated workflow, so that identity and data come back online in the correct sequence rather than in disconnected stages that extend downtime.
The MSP dimension
For managed service providers, the stakes carry an additional commercial edge. MSPs are bound by SLAs with their clients and must deliver recovery outcomes on contracted timelines, often with constrained staffing. The same principles apply — independent backup, immutable storage, tested restoration — but the operational simplicity of the solution matters considerably. A platform that demands significant human intervention or specialist expertise to operate under pressure is a liability when an incident lands at an inconvenient hour.
Why it matters
Every CISO running workloads in the Microsoft ecosystem needs a clear-eyed view of where vendor responsibility ends and their own begins. The shared responsibility model is not a technicality — it is a contractual reality with direct implications for recovery time objectives, regulatory standing, and business continuity. Microsoft tracking more than 4,000 identity attacks per second means the threat to Entra ID is not theoretical. If your recovery plan assumes Microsoft will restore your data to a pre-attack state, that plan will fail when tested.
What to do now
- Audit your current understanding of Microsoft’s shared responsibility model and document explicitly what data recovery obligations fall to your organisation rather than to Microsoft.
- Review whether Microsoft 365 and Entra ID are covered by independent, immutable, cloud-to-cloud backup stored outside the primary Microsoft tenant.
- Assess whether hybrid environments — on-premises, SaaS, and IaaS/PaaS — are protected and recoverable to an equivalent standard, and address any inconsistencies.
- Ensure your recovery workflow restores Microsoft 365 and Entra ID together in a coordinated sequence so that identity and data access are re-established in the right order.
- Verify that your cyber insurance and applicable compliance frameworks are satisfied by your current backup and recovery posture, and close any gaps before your next review cycle.
