Microsoft’s Message Center post MC1472007, published on 14 September 2026 and updated the next day, sets a deadline. From 25 October 2026, uploads of advanced agent packages are enabled for every user in an organisation’s Microsoft 365 environment unless an administrator has chosen no users or named users or groups. An advanced package is one that carries an agent with actions, or with a Model Context Protocol server: the plumbing that lets an agent call other systems. The control has sat in the Microsoft 365 admin centre under Copilot settings since 25 September. Where nobody has looked at it by 25 October, the default applies.
An agent in Microsoft 365 is software that takes a goal in plain language and works towards it: reading files, drafting, and, where its actions allow, creating, updating and deleting records in other systems. Microsoft’s own documentation says that with a plugin for an API – an application programming interface – or a Model Context Protocol server, users can ask an agent to “create, update, and delete data and objects through natural language prompts”. The agent does this with the permissions of the person who runs it. Whatever that person can reach, the agent can reach.
In April 2026 an AI coding agent working for a small software company met a credential mismatch and decided to fix it. Using an API token it found in an unrelated file, it called the cloud provider’s interface and deleted the volume holding the production database. The backups sat on the same volume, so they went too. The founder put the elapsed time at nine seconds. The provider recovered the data, and on 1 May 2026 it changed its API so that volume deletions through it are now held for 48 hours before they become final, as its dashboard already did.
The incident carries over to any Microsoft 365 environment. The damage was done by a tool the company had chosen. The deletion ran at machine speed through an interface that asked for no confirmation.
Microsoft 365 includes no independent backup by default. SharePoint and OneDrive keep deleted items for 93 days from deletion. A site collection administrator can delete items from the second-stage recycle bin before then, and a bin that exceeds its quota purges its oldest items. Microsoft keeps backups of site content for 14 days beyond that, and a restore from them returns a whole site collection, by request to Microsoft Support; single files, lists and libraries cannot be restored that way. Exchange Online keeps permanently deleted items for 14 days by default and 30 at most.
When versions exceed a library’s limit they are marked for permanent deletion, and that deletion bypasses the recycle bin. Microsoft’s own backup documentation says that versions “might also be exhausted depending on the version limit set by the admin”. An agent that saves a file over and over can push every good version out of reach.
If an agent, or the person running it, or an attacker holding either one’s credentials, has the right to delete the data, can the same right delete the copy? Where the answer is yes, the backup shares the data’s fate.
Design follows from that answer:
The protection units of Microsoft 365 Backup are OneDrive accounts, SharePoint sites and Exchange mailboxes; agents are not among them. One third-party vendor announced backup and restore of agents built in Copilot Studio, Microsoft’s agent-building tool, on 21 July 2026 and called it a first for the market. Whether a company’s tool captures agents, instructions and knowledge sources is a question to put to the vendor in writing.
Stefan Walter, chief executive of FINMA, the Swiss Financial Market Supervisory Authority, told the Small Bank Symposium in Bern on 7 September 2026 that artificial intelligence can assist banks with detecting attacks, and that “it can also make attacks easier to automate and scale”. A store that no stolen identity can delete holds against the attacker and the runaway agent alike.
FINMA Circular 2023/1, in force since 1 January 2024, requires banks, persons under Article 1b of the Banking Act, securities firms, financial groups and financial conglomerates to implement “adequate back-up processes and recovery processes that are tested and validated regularly”. The most important business continuity and disaster recovery measures must be tested at least once a year, though banks and securities firms in FINMA categories 4 and 5 are exempt from that annual clause. Portfolio managers sit outside the circular altogether. A restore test that rehearses an agent incident, rolling back one identity’s actions over one window, is the test that now matters.
Article 958f of the Code of Obligations applies to every company: accounting records and vouchers must be kept for 10 years and must be capable of being “made readable again at any time”. A backup that an agent can delete, or that expires with a recycle bin, does not meet a 10-year duty.
Where the copy sits matters as much as how it is protected. For a Geneva company the backup belongs in Switzerland, under Swiss law, for the same reasons as the live data; the data-residency article published alongside this one sets them out.
An AI-era backup is a design decision, and the first deadline is 25 October. Put this on your agenda, we can help you get there.