--- title: "Microsoft 365 as SaaS: what Microsoft runs and what admins must secure" description: "What Microsoft runs, what the tenant admin owns, the 300-seat cap and deletion windows worked through, and a short security checklist for small companies." canonical: "https://saascron.com/microsoft-365-saas/" language: "en-US" author: "Ricardo Machado" author_url: "https://saascron.com/author/ricardo-machado/" published: "2026-10-17T07:00:00-04:00" updated: "2026-10-17T07:00:00-04:00" category: "Platforms" tags: ["Microsoft 365", "Platforms", "SaaS security", "Admin"] --- # Microsoft 365 as SaaS: what Microsoft runs and what admins must secure > What Microsoft runs, what the tenant admin owns, the 300-seat cap and deletion windows worked through, and a short security checklist for small companies. You have just been given the admin password for your company's Microsoft 365 account, and nobody explained what is now your job and what Microsoft does for you. The short version: Microsoft 365 is SaaS, so Microsoft runs the data centers, servers, software and network. You own the users, the settings and the data, and most problems that make the news start on your side of that line. This guide shows the split in a table, works through the two limits that catch new admins (the 300-seat cap and the deletion windows) and ends with a ten-point checklist for your first week. For the general idea of SaaS and "who manages what", see [What is SaaS?](https://saascron.com/what-is-saas/). If your company also weighs Google's suite, the same questions are answered for it in [Google Workspace as SaaS](https://saascron.com/google-workspace-saas/). ## Microsoft 365 in plain terms Think of a hotel. The hotel keeps the building standing, the lights on, the lifts working and the doors locked at night. You decide who gets a key card to your room, what goes into the safe and whether you leave the door open for a friend. If you hand a key card to the wrong person, the hotel's security guard cannot help. Microsoft 365 is the hotel. Your organization's space in it is called a **tenant**: one account that holds your users, mailboxes, files and settings, separated from every other customer on the same system. The **admin** (administrator) is the person who manages that tenant, and Microsoft 365's identity service, Microsoft Entra ID, is where the key cards are issued. ## What Microsoft runs and what you own Microsoft publishes a [shared responsibility matrix](https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility) that names Microsoft 365 as its SaaS example. The table below takes its SaaS column and adds what each row means in a Microsoft 365 tenant. | Area | Who is responsible | What it means for your tenant | |---|---|---| | Customer data | You | What is stored, who it is shared with, how long it is kept | | Configurations and settings | You | Sharing defaults, mail rules, retention, guest access | | Identities and users | You | Accounts, passwords, multifactor authentication, admin roles | | Client devices | Shared | Microsoft offers device management; you protect the laptops and phones | | Applications | Shared | Microsoft runs the apps; you configure them and control access | | Network, operating systems, hosts, data centers | Microsoft | Nothing for you to patch | Microsoft's own wording is short: "For all cloud deployment types, you own your data and identities." The three rows marked "You" are where an admin's time goes. Deleted data is the area most often misunderstood. Exchange Online keeps a deleted user's mailbox for 30 days before permanent deletion ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/delete-or-restore-mailboxes)). SharePoint and OneDrive keep deleted items for 93 days across both recycle bins ([Microsoft Learn](https://learn.microsoft.com/training/modules/explore-archiving-records-management/7-restore-deleted-data-sharepoint-online)). These are recovery windows, not backups. If you need a file from six months ago, those windows do not help. ## The business plans and their limits Microsoft sells three main business plans, from the smallest to the largest: Business Basic, Business Standard and Business Premium. The main differences, per Microsoft's [plan options](https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-365-plan-options) page: Basic has the web versions of the apps only, and Standard adds the desktop apps. Premium adds security and device management features such as Azure Information Protection. Each step up costs more per user per month. Prices change. Microsoft [announced](https://www.microsoft.com/en-us/microsoft-365/blog/2025/12/04/advancing-microsoft-365-new-capabilities-and-pricing-update/) on December 4, 2025, that new list prices would take effect on July 1, 2026. Check [Microsoft's current price list](https://www.microsoft.com/en-us/microsoft-365/business/microsoft-365-plans-and-pricing) for your country before you budget, and price each plan per user per month, paid yearly. You can mix plans in one tenant: Premium for the people who handle money and admin rights, Standard or Basic for everyone else. The limit is the size of the whole Business family. Microsoft says the business plans "are designed for organizations with up to 300 users," and that it may enforce "the tenant limit of 300 provisioned licenses across the Business family of plans." **Example:** your company has 220 employees on Business Standard. You want Premium for 60 of them in finance, HR and IT. - Moving 60 people from Standard to Premium changes the plan mix, not the seat count: 160 Standard + 60 Premium = 220 seats. - Room left in the Business family: 300 - 220 = 80 seats. - If you plan to hire 40 people next year, you reach 220 + 40 = 260 seats, still inside the cap. - If you plan to hire 100, you need 320 seats. That is 20 above the cap, so you plan a move to the enterprise plans, which have no user limit, before the hiring starts. Microsoft's own example on the same page is the shortcut: with 250 Premium seats, you can add only 50 more seats across all Business plans. **Example:** the deletion windows, on a calendar. An employee leaves, and you delete their account on March 2, 2026. On the same day a colleague deletes a project folder from a SharePoint site by mistake. - The leaver's mailbox can be restored for 30 days: until April 1, 2026. - The deleted folder can be restored for 93 days: 29 days to the end of March, 30 in April and 31 in May make 90, so until June 3, 2026. - After those dates, without a retention policy or a separate backup, the data is gone. ## Checklist for your first week as admin Microsoft's [security defaults](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults) page is the source for the first four items. - Check that security defaults are on, or that Conditional Access policies replace them. Security defaults require every user to register for multifactor authentication and block legacy authentication protocols. - Create two cloud-only emergency access accounts with the Global Administrator role, as Microsoft recommends, and store their credentials offline. - Give admins a separate admin account for admin work and a normal account for email and documents. - Count your Global Administrators. Give everyone else the narrowest admin role that does the job. - Review the external sharing setting for SharePoint and OneDrive, and choose who outside the company can receive links. - Review guest users and remove the ones who no longer work with you. - Write an offboarding procedure that saves a leaver's mail and files before the 30-day mailbox window closes. - Decide in writing whether you need a backup beyond the recycle bins, and who owns it. - Confirm the audit log is searchable and that someone knows how to search it. - Put the renewal date, the number of licenses and the distance to the 300-seat cap on a calendar, so the plan mix is reviewed before each renewal. ## Common mistakes 1. **Assuming Microsoft backs up your data indefinitely.** Microsoft keeps deleted mailboxes for 30 days and deleted SharePoint and OneDrive items for 93 days. Why it happens: "it's in the cloud" sounds like "it's safe forever". Instead: decide on retention policies or a separate backup, and test a restore. 2. **One shared admin account.** If its password leaks, every setting in the tenant is exposed, and you cannot tell who did what. Why it happens: it was set up that way on day one. Instead: named admin accounts with multifactor authentication, plus the two emergency accounts. 3. **Turning off security defaults without a replacement.** Microsoft's page says organizations that disable them "should immediately enable Conditional Access policies." Why it happens: an old printer or app stops working. Instead: fix or replace the legacy client, or move to Conditional Access first. 4. **Buying one plan for everybody by habit.** A mix of plans can cost less with the same protection where it matters. Why it happens: one plan is simpler to buy. Instead: price the mix from Microsoft's current price list at each renewal, and count the seats left under the 300 cap. ## Sources - Microsoft, [Shared responsibility in the cloud](https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility), checked October 2026. - Microsoft, [Microsoft 365 and Office 365 plan options](https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-365-plan-options), checked October 2026. - Microsoft, [Advancing Microsoft 365: new capabilities and pricing update](https://www.microsoft.com/en-us/microsoft-365/blog/2025/12/04/advancing-microsoft-365-new-capabilities-and-pricing-update/), December 4, 2025. - Microsoft, [Microsoft 365 business plans and pricing](https://www.microsoft.com/en-us/microsoft-365/business/microsoft-365-plans-and-pricing) (current price list; prices not quoted here). - Microsoft, [Delete or restore user mailboxes in Exchange Online](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/delete-or-restore-mailboxes) and [Security defaults in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults), checked October 2026. ## In three sentences Microsoft 365 is SaaS: Microsoft runs the infrastructure and the applications, and you own the data, the settings and the user accounts. Deleted mailboxes are kept for 30 days and deleted SharePoint and OneDrive items for 93 days, which are recovery windows and not backups. You can mix Basic, Standard and Premium in one tenant, but the whole Business family is capped at 300 seats, so plan the move to enterprise plans before you hire past it. --- Canonical: