As organizations migrate critical workflows to SaaS platforms like Microsoft 365, a dangerous misunderstanding persists among IT administrators: the belief that hosting data in the cloud is the same as backing it up.

While Microsoft excels at providing high availability, infrastructure resilience, and platform uptime, SaaS data protection ultimately rests on your shoulders. Relying solely on native cloud recycle bins leaves critical gaps in data sovereignty, compliance, and disaster recovery.

This article breaks down the Shared Responsibility Model, explains how to overcome native SaaS retention limits, and provides a step-by-step guide to backing up Microsoft 365 mailboxes and SharePoint sites directly to your private cloud storage using Duplicati.

1. The SaaS "Shared Responsibility Model"

Why Cloud Recycle Bins Aren't True Disaster Recovery

Microsoft operates under a Shared Responsibility Model. In simple terms:

• Microsoft’s Job: Keep the infrastructure online, patch software, ensure datacenter redundancy, and guarantee service uptime.

• Your Job: Protect the data itself—ensuring security, retention, compliance, and disaster recovery.

+-------------------------------------------------------------+
|               THE SHARED RESPONSIBILITY MODEL               |
+-------------------------------------------------------------+
| MICROSOFT RESPONSIBILITY  | Platform Uptime & Datacenter    |
|                           | Infrastructure Availability    |
+---------------------------+---------------------------------+
| YOUR RESPONSIBILITY       | Data Ownership, Governance,     |
|                           | Encryption & Long-Term Backup

+-------------------------------------------------------------+
|               THE SHARED RESPONSIBILITY MODEL               |
+-------------------------------------------------------------+
| MICROSOFT RESPONSIBILITY  | Platform Uptime & Datacenter    |
|                           | Infrastructure Availability    |
+---------------------------+---------------------------------+
| YOUR RESPONSIBILITY       | Data Ownership, Governance,     |
|                           | Encryption & Long-Term Backup

+-------------------------------------------------------------+
|               THE SHARED RESPONSIBILITY MODEL               |
+-------------------------------------------------------------+
| MICROSOFT RESPONSIBILITY  | Platform Uptime & Datacenter    |
|                           | Infrastructure Availability    |
+---------------------------+---------------------------------+
| YOUR RESPONSIBILITY       | Data Ownership, Governance,     |
|                           | Encryption & Long-Term Backup

Many IT teams discover too late that native toolsets (such as the Microsoft 365 Recycle Bin or Retention Policies) are built for operational recovery, not formal backup:

• Strict Time-Outs: Deleted items in SharePoint or Exchange are purged permanently after short retention windows (often 30 to 90 days) unless complex soft-delete mechanisms are configured.

• Ransomware Vulnerability: If malware or a compromised admin account wipes files or executes malicious synchronization, native retention policies can be overwritten or emptied entirely.

• No Air-Gapping: Storing backups within the exact same ecosystem as your operational tenant creates a single point of failure.

Key Takeaway: Native cloud recycling is not disaster recovery. True protection requires isolated, versioned, immutable backups decoupled from the productivity suite.

2. Data Sovereignty & The Case for Private Cloud Storage

Bringing M365 Data Home: Local SANs & Private S3 Clusters

Regulatory frameworks such as GDPR, NIS2, HIPAA, and regional data protection acts mandate strict control over where sensitive corporate data resides and how long it is retained.

When your data lives purely inside a proprietary SaaS ecosystem, fulfilling these compliance mandates becomes challenging:

• Data Sovereignty: Many laws require customer or health records to remain within specific geographic boundaries, or even on-premises.

• Storage Cost Control: Long-term retention in native SaaS platforms often triggers steep tier upgrades.

• Storage Independence: By streaming M365 backups to local Storage Area Networks (SANs), Network-Attached Storage (NAS), or private S3-compatible clusters (e.g., MinIO, Ceph, or local object stores), you gain 100% control over your data footprint and costs.

Duplicati enables hybrid cloud workflows by letting you protect cloud-native data (SharePoint, Exchange, OneDrive) while retaining total control over the destination storage.

3. Step-by-Step Guide: Backing Up M365 to Private Storage with Duplicati

Duplicati leverages the Microsoft Graph API to seamlessly extract mailboxes, SharePoint site collections, lists, and collaboration files, encrypting them before transmitting them to your target storage.

  +-----------------------+              +-----------------------+              +-----------------------+
  |  Microsoft 365 Tenant |              |   Duplicati Engine    |              | Private Cloud Storage |
  | (Mail, SharePoint,    |  =======>    | (AES-256 Encryption & |  =======>    | (Local SAN / NAS /    |
  |  OneDrive, Teams)     |  Graph API   |  Deduplication)       |   S3 / SFTP  | Private S3 Cluster)

  +-----------------------+              +-----------------------+              +-----------------------+
  |  Microsoft 365 Tenant |              |   Duplicati Engine    |              | Private Cloud Storage |
  | (Mail, SharePoint,    |  =======>    | (AES-256 Encryption & |  =======>    | (Local SAN / NAS /    |
  |  OneDrive, Teams)     |  Graph API   |  Deduplication)       |   S3 / SFTP  | Private S3 Cluster)

  +-----------------------+              +-----------------------+              +-----------------------+
  |  Microsoft 365 Tenant |              |   Duplicati Engine    |              | Private Cloud Storage |
  | (Mail, SharePoint,    |  =======>    | (AES-256 Encryption & |  =======>    | (Local SAN / NAS /    |
  |  OneDrive, Teams)     |  Graph API   |  Deduplication)       |   S3 / SFTP  | Private S3 Cluster)

Here is how to set up Microsoft 365 backups in Duplicati:

Step 1: App Registration in Microsoft Entra ID (Azure AD)

To allow Duplicati to interact securely with your tenant, create an App Registration in Microsoft Entra ID:

1. Navigate to the Microsoft Entra admin center > App registrations > New registration.

2. Note your Tenant ID and Application (Client) ID.

3. Under Certificates & secrets, generate a Client Secret (or upload an X.509 certificate for high-security environments).

4. Grant the necessary API Permissions (Microsoft Graph) with Application permissions:

   • Mail.Read / Mail.ReadWrite (for Mailboxes)

   • Sites.Read.All / Sites.ReadWrite.All (for SharePoint site collections and lists)

   • Files.Read.All (for OneDrive/SharePoint files)

5. Click Grant admin consent for [Your Organization].

Step 2: Configure a New Backup Job in Duplicati

1. Open the Duplicati UI and click Add backup > Configure a new backup.

2. Name your backup (e.g., M365-SharePoint-Mail-PrivateS3).

3. Set a strong passphrase for AES-256 End-to-End Encryption. (Duplicati encrypts all data locally before sending it across the wire).

Step 3: Choose Your Private Destination Storage

Under Destination:

• Select S3 Compatible (for private object stores like MinIO/Ceph) or SFTP / SMB (for local SAN/NAS deployments).

• Enter your endpoint URL, credentials, and target bucket/folder name.

Step 4: Add Microsoft 365 as Source

1. On the Source Data step, click Add remote path.

2. Search or select Microsoft 365.

3. Input your Tenant ID, Client ID, and Client Secret (or Certificate).

4. Test the connection to verify authentication.

Step 5: Define Scope & Filters

By default, Duplicati will protect all root types (Users, Groups, Sites). You can apply fine-grained inclusion/exclusion rules using advanced options:

• SharePoint: Target specific site collections, subsites, and document libraries.

• Mailboxes: Select individual or shared mailboxes, user calendars, and contacts.

• Advanced flags like --office365-included-root-types allow you to isolate core assets to balance backup speeds and storage requirements.

Step 6: Schedule and Execute

Set your backup frequency (e.g., daily incremental backups) and retention rules. Save and run the backup. Duplicati will build deduplicated, encrypted volumes on your private cloud destination.

4. Key Advantages of Duplicati’s Hybrid Approach

Take Control of Your SaaS Strategy

Outsourcing your software layer to the cloud shouldn’t mean surrendering control over your business-critical data. By pairing Microsoft 365 with Duplicati, IT teams can bridge the gap between SaaS convenience and hybrid cloud compliance - ensuring that every email, document, and SharePoint site remains secure, encrypted, and under their control.

You can try the MS365 backup today with up to 5 users/groups/sites. If you want to hear more or obtain an evaluation license, contact Duplicati Sales.