Long-form write-ups of the architectural decisions behind the platform: what we built, and why we chose one approach over another.
Microsoft keeps the service running. Protecting the data inside it is your job — and that split is written into the agreement.
Recycle bins and retention policies keep data for a while. A backup is a separate copy you control — and the difference shows up during a restore.
Per-user rates are the easy part. The bill is made of the four things vendors don’t put on the landing page.
Append-only is the easy half — four engineering properties separate a log file from a tamper-evident chain
What WORM and Object Lock actually guarantee — and the gap between a backup an attacker can delete and one nobody can.
The thing an attacker manipulates is the policy graph — and that is what a recovery has to rebuild
Side-by-side, in-place, and the destructive revert — the blast-radius decision behind a recovery
Seven steps and two authentication events, or four and one
Why 200 tenants and a 99% accurate engineer still produce 12 wrong settings
Read operations have no blast radius. Write operations are not reversible by the person who caused them
The covered list is marketing. The not-covered list is where your restore fails
An 8-hour window on a 200-seat tenant is roughly 8,000 unrecoverable messages
A failed restore raises a ticket. A successful unauthorised one raises nothing at all
Three of the four cannot be answered from anybody's marketing page
A 500-seat client at 8% churn carries 280 departed users by year seven
The vendor is not party to your storage contract, which is the whole point
Model the offboarding case, not the growth case
Four numbers, no spreadsheet, no call to the vendor
Any vendor claiming both should be asked which one they implemented
Sixty clients, forty-five seconds a switch, about 190 hours a year
Which is why seat drift only ever moves one direction on your P&L
A fair reading of what Microsoft shipped, and the five limits it states itself
The sanction depends on what the court finds about your intent
And the one thing neither licence tier does
