Microsoft 365 Is Not a Backup: What Expires and When

Microsoft 365 keeps your email and files available, but it is not a backup. Deleted email can be recovered for 14 days by default and 30 days at most, a former employee's OneDrive is kept for a limited window after the account is deleted, and once those windows close, no standard Microsoft 365 feature can bring the data back. An independent backup keeps copies for as long as you decide.

The short answer

Microsoft runs a highly available service. Your mailboxes and files are replicated so that a failure in Microsoft's own infrastructure does not take your work with it. That protects you against Microsoft losing your data. It does not protect you against your own people, or an attacker, deleting or overwriting it.

The recovery features built into Microsoft 365 are designed for recent mistakes, and they work on a countdown. A backup works on a schedule you set and keeps copies apart from the data it protects.

What Microsoft 365 keeps, and for how long

These are Microsoft's defaults for a standard tenant. Retention policies and holds can change them, which is covered further down.

• Deleted email. When someone empties their Deleted Items folder or presses Shift+Delete, the message moves to a hidden Recoverable Items folder and stays there for 14 days by default. An administrator can raise that to 30 days per mailbox, and no higher without a hold.
• A former employee's OneDrive. When a user account is deleted, their OneDrive is kept for 30 days by default and their manager is given access to it. After that it sits in a deleted state for 93 days, where only a SharePoint administrator can restore it.
• Deleted SharePoint sites. Kept for 93 days, then permanently deleted along with their lists, libraries and pages.
• A deleted team. Deleting a team deletes the Microsoft 365 group behind it. The group, its mailbox, its SharePoint site and the team itself can be restored for 30 days. After that they are gone.

Every one of these windows ends. Once it closes, the data cannot be recovered with the tools Microsoft 365 includes as standard.

Where the gaps show up

The leaver whose files were needed later

A staff member resigns, the account is deleted and the licence is freed for the next hire. Three months later, finance needs a spreadsheet that only ever lived in that person's OneDrive. By then the 30-day window has passed, and unless someone acted in time, the files are on their way out or already gone. We covered the wider offboarding problem in The account nobody closed.

The mistake nobody noticed

Someone deletes a folder of project email or overwrites a shared document, and nobody notices until the next quarter. The recovery windows above assume a mistake is spotted quickly. Many are not.

Ransomware and malicious deletion

Ransomware that reaches a synced folder can encrypt files that then sync up to OneDrive and SharePoint, and an attacker holding an administrator account can delete data on purpose. Microsoft 365 has tools to roll files back, but they work inside the same tenant, under the same accounts the attacker may control. A backup held separately, with its own access, is much harder to reach.

Retention policies are not backups

Microsoft Purview retention policies and litigation holds can keep content far longer than the defaults. They are built for compliance: they stop content from being permanently deleted so it can be found and produced later. They are not built for quick, everyday restores.

Recovering a held item usually means an administrator searching for it and exporting it, not a user clicking Restore. Some hold features also need higher licences than many small businesses run. Retention has its place, especially for records you are required to keep, but it does not replace a copy you can restore from in minutes.

What an independent backup adds

• Your own retention. Copies are kept for as long as you decide, not for a fixed 14, 30 or 93 days.
• Separation. Copies sit outside the day-to-day accounts, so a compromised admin account or a deleted user does not take the backup with it.
• Point-in-time restores. You can bring back a single email, a file as it was last Tuesday, or a whole mailbox.
• Coverage for leavers. Depending on the product, a former employee's mailbox and OneDrive can be kept after the licence is freed.

Microsoft now sells its own Microsoft 365 Backup service as a pay-as-you-go add-on, and a range of third-party products do the same job. Coverage differs between them. Microsoft's own service, for example, currently protects the files behind Teams channels but not the chats themselves. Check exactly what each option covers before you choose.

A checklist before you rely on any backup

1. List what needs protecting: mailboxes, OneDrive accounts, SharePoint sites and Teams, including shared mailboxes and recent leavers.
2. Decide how far back you need to be able to go, and how quickly a restore must happen.
3. Check that backup copies sit outside the accounts they protect, with separate administrator access and multifactor authentication.
4. Decide what happens to a leaver's data before the account is deleted, not after.
5. Run a test restore: one email, one file and one whole OneDrive. Time each one.
6. Repeat the test on a schedule and keep a record of the result.

Frequently asked questions

Does Microsoft 365 back up my data?

Microsoft keeps your data available and replicated against failures in its own service. It does not keep long-term copies you can restore from after you delete or overwrite something. Its recovery features, such as Recoverable Items and the recycle bins, work for a limited number of days.

How long can I recover deleted emails in Microsoft 365?

For 14 days by default after they leave the Deleted Items folder. An administrator can extend this to 30 days per mailbox. Anything longer needs a retention policy, a hold or a separate backup.

What happens to a former employee's OneDrive in Microsoft 365?

When the account is deleted, the OneDrive is kept for 30 days by default and the manager is given access. It is then held in a deleted state for 93 days, restorable only by a SharePoint administrator, and after that it is permanently removed. Retention policies can change these timings.

Isn't the recycle bin enough?

For a file deleted yesterday, often yes. For a mistake found months later, a leaver whose account has already been removed, or an attack carried out with an administrator account, the recycle bin is not designed to help.

How often should we test restores?

At least once a quarter, and after any change to how the backup is set up. A backup that has never been restored is an assumption, not a plan.

Where to start

Onprem2Cloud IT Solutions Co. is a Microsoft CSP partner based in Muntinlupa City, Metro Manila. We set up independent backup for Microsoft 365 mail, OneDrive, SharePoint and Teams, billed in pesos with official receipts, and we test a restore before we hand it over. See our cybersecurity services, or tell us what you need to protect.