Probably not in one place—and that is not necessarily a problem.
Business information may sit in email, Teams, SharePoint, OneDrive, a CRM, an accounts platform, specialist applications, supplier portals and folders saved to individual devices.
Even within Microsoft 365, different services hold different kinds of customer data. The issue is not that several systems exist. It is whether the business understands what each one contains and why.
Here, “where” is not only a question of geography. It is about the systems, copies, owners and dependencies the business relies on.
“It’s in Microsoft 365” is not a complete answer
A client document may arrive as an email attachment, be downloaded to a laptop, shared through Teams, saved into a SharePoint library and uploaded to another business system.
At that point, where does it live?
The practical answer may be “in several places.” The more important questions are: which copy is current, which is the official record, who can access it, and what happens when it changes?
A platform name alone does not answer those questions.
The source of truth matters
When several copies exist and none has a clearly agreed purpose, people create their own working methods.
One colleague updates a spreadsheet while another works from the CRM. A procedure remains in someone’s mailbox. A key document sits in an individual’s OneDrive because nobody decided where team information should be held.
Nothing may be technically broken, yet the business becomes dependent on memory and local knowledge.
Visibility makes better work possible
Knowing where important data lives makes it easier to give people appropriate access, onboard colleagues, remove access cleanly, reduce duplication, plan recovery and connect applications.
It also matters before automation. If the business has not decided which information is trusted, automation can simply move inconsistency faster.
Not everything belongs in one system
The answer is not to force every piece of information into a single repository.
Accounts belong in an accounting system. Client relationships may belong in a CRM. Working documents may belong in SharePoint. Different applications can have legitimate roles.
The goal is intentionality. For each important type of information, the business should be able to answer:
- Which system is the source of truth?
- Who owns it and who should have access?
- Where is it copied, synchronised or exported?
- How long is it needed?
- How would it be recovered or handed over if a person or system became unavailable?
Knowing which assets matter, who owns them and how critical they are also supports faster response and recovery when circumstances change.
A useful question for a small business is:
Can we explain where critical information is held, which copy is authoritative, who can access it and how the business would continue—without relying on one person’s memory?
When the answer is yes, data stops being scattered by accident and becomes a managed part of the business.

