Microsoft 365 does not back up your data in the way most business owners mean. It keeps deleted files in SharePoint and OneDrive for up to 93 days, and deleted email for 14 days by default (up to 30 if an admin changes it). After that, the data is permanently deleted. To recover anything older, or to recover from a bad sync or ransomware that went unnoticed, you need a separate tested backup.
Many small businesses now run on Microsoft 365: email in Exchange Online, files in OneDrive and SharePoint, chat in Teams. Because it is “in the cloud”, it is easy to assume it is backed up. Below is what Microsoft actually keeps, for how long, according to Microsoft’s own documentation, and what to do about it.
How long does Microsoft 365 keep deleted data?
Microsoft 365 keeps deleted data for between 14 and 93 days by default, depending on where it lived.
| Where | What happens when something is deleted | How long you can get it back (Microsoft’s defaults) |
|---|---|---|
| OneDrive and SharePoint files | Goes to the site Recycle Bin, then to a second-stage Recycle Bin that only an admin can see | 93 days across both stages, then permanently deleted |
| A whole SharePoint or Teams site | Deleted site | 93 days |
| Email (Exchange Online) | Deleted Items folder, then the Recoverable Items folder | Recoverable Items keeps deleted mail for 14 days by default; an admin can raise this to a maximum of 30 days |
| A user whose licence is removed | Exchange Online data is held | 30 days, then deleted and not recoverable |
| A user account that is deleted | Mailbox is soft-deleted; OneDrive is marked for deletion | Mailbox: 30 days. OneDrive: kept 30 days by default (an admin can change this), then moved to the recycle bin for 93 days |
Three things stand out. The longest default window is about three months. The email window can be two weeks. And these are recycle bins and grace periods, not backups: they help with one accidental deletion, not with someone deleting everything, a sync overwriting a folder, or a problem nobody notices for a few months.
Is Microsoft 365 data backed up automatically?
No, not in the sense of a separate copy you control and can restore from at any date. Microsoft 365 gives you recycle bins, version history, a “Restore your OneDrive” feature that can roll a OneDrive back up to 30 days, and optional retention policies. Each has a time limit or needs an admin to set it up first.
Retention policies and holds are worth knowing about, but they are not a restore tool. Microsoft describes the place where retained SharePoint and OneDrive files are kept, the Preservation Hold library, as a hidden system location that “isn’t designed to be used interactively.” It is not a restore tool.
How do small businesses lose Microsoft 365 data?
Most Microsoft 365 data loss comes from ordinary events, not Microsoft outages. Five common ones:
1. The departed employee. Someone leaves and their licence is removed to save the monthly fee. Microsoft holds the Exchange Online data for 30 days, then deletes it, along with any client correspondence nobody exported.
2. The quiet deletion. A shared folder is tidied up in March. In July someone needs a file from it. The 93 days ran out in June.
3. Ransomware on a laptop. OneDrive syncs the encrypted files to the cloud. Restore your OneDrive can roll back up to 30 days, but only if someone notices in time.
4. The bad sync. A new laptop is set up with OneDrive pointed at the wrong folder, and files are overwritten.
5. The retention policy nobody set. Retention policies and holds only work once an admin has configured them, and even then they keep copies for compliance rather than give you a quick restore.
None of these is a Microsoft failure, so Microsoft’s own protections are not designed to cover them.
What does a real Microsoft 365 backup do?
A dedicated Microsoft 365 backup copies email, OneDrive, SharePoint and Teams data to separate storage on a schedule, and keeps versions for as long as you choose. You can then restore one email, one file, a folder, a mailbox or everything, from a point in time well beyond Microsoft’s default windows.
What matters most is that someone checks it. As our data backup and recovery page puts it, “A backup that silently stopped running months ago is worse than no backup at all.”
How can you check your own Microsoft 365 in ten minutes?
1. Look for former staff. Open the Microsoft 365 admin center and check users who have left. If their licence was removed or their account deleted, their mailbox may already be in its 30-day countdown.
2. Ask where the backup is. Ask whoever runs your IT: “Where is our Microsoft 365 data backed up, outside Microsoft, and when did we last restore something from it?” If the answer is a pause, you probably don’t have one.
3. Check two-factor authentication. Ask whether two-factor authentication is on for every mailbox. As our cybersecurity page says, most of the hacked accounts we see would have been stopped by it.
How we help Portland businesses protect their data
We set up a consistent backup system, on site and in the cloud, and monitor it with daily digital health checks. That covers file, folder and full-system recovery, backup of servers, workstations and business applications, and recovery planning for ransomware and hardware failure. Our managed IT plans include professional-grade data backup and recovery, monitored continuously.
If you want to know whether your Microsoft 365 data is actually protected, request a free on-site evaluation or call 207-653-4143. We review your computers, network, backups and security, and you get clear recommendations and a quote, with no obligation.
FAQs
Does Microsoft 365 back up my data? Not as a separate, long-term backup. Microsoft keeps deleted files for up to 93 days and deleted email for 14 days by default (30 at most), then permanently deletes them.
How long does the SharePoint recycle bin keep files? 93 days in total across the first-stage and second-stage recycle bins, according to Microsoft. After that, the file is permanently deleted.
How long are deleted emails kept in Microsoft 365? Items in the Recoverable Items folder are kept for 14 days by default. An admin can raise that to a maximum of 30 days.
What happens to a mailbox when an employee leaves? If the licence is removed, Microsoft holds the Exchange Online data for 30 days, then deletes it. If the user account is deleted, the mailbox can be recovered for 30 days. Export or back up anything you need before then.
Can OneDrive recover from ransomware? Restore your OneDrive can roll a OneDrive back to any point in the last 30 days. Anything older, or anything permanently deleted from the recycle bin, needs a separate backup.
Sources
- Microsoft Learn, “Learn about retention for SharePoint and OneDrive”: https\://learn.microsoft.com/en-us/purview/retention-policies-sharepoint
- Microsoft Learn, “Restore deleted sites”: https\://learn.microsoft.com/en-us/sharepoint/restore-deleted-site-collection
- Microsoft Learn, “Recoverable Items folder in Exchange Online”: https\://learn.microsoft.com/en-us/exchange/security-and-compliance/recoverable-items-folder/recoverable-items-folder
- Microsoft Learn, “Delete or restore user mailboxes in Exchange Online”: https\://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/delete-or-restore-mailboxes
- Microsoft Learn, “Assign or unassign licenses for users in the Microsoft 365 admin center”: https\://learn.microsoft.com/en-us/microsoft-365/admin/manage/remove-licenses-from-users
- Microsoft Learn, “OneDrive retention and deletion”: https\://learn.microsoft.com/en-us/sharepoint/retention-and-deletion
- Microsoft Support, “Restore your OneDrive”: https\://support.microsoft.com/en-us/office/restore-your-onedrive-fa231298-759d-41cf-bcd0-25ac53eb8a15
- Information Systems of Maine, Data Backup & Recovery
- Information Systems of Maine, Cybersecurity & Virus Removal
- Information Systems of Maine, Managed IT Services
