Is your data backed up just because it lives in Microsoft 365? Not in the way most people mean. Microsoft keeps the service running and keeps deleted items for a while, but recycle bins, retention and litigation hold each have limits, and none of them is a point-in-time Microsoft 365 backup you can roll back to. Here is what Microsoft keeps by default, where the gaps are, and what a real restore test should prove.
Sources: Microsoft Learn: Recoverable Items folder, delete or restore mailboxes, and Microsoft Support: SharePoint recycle bin.
Who is responsible for Microsoft 365 backup?
Microsoft’s shared responsibility model is plain about it: “you own your data and identities.” For software-as-a-service like Microsoft 365, the responsibility matrix leaves customer data, identities and users, and configuration with the customer. Microsoft handles the physical datacenters, hosts, network, and operating systems. Among the duties Microsoft says you always keep: “You’re responsible for your data, including data classification, data protection…”
Microsoft does build in redundancy. Its Microsoft 365 Backup FAQ draws the line, though: a disaster recovery copy “maintains the current state of content, not any historical versions from prior points in time.” If something deletes or encrypts your files, the replicated copy has the same damage. The same FAQ says Microsoft’s view on shared responsibility for data protection hasn’t changed.
Microsoft’s consumer Services Agreement puts it more bluntly: “We recommend that you regularly backup Your Content and Data.” Business tenants run under separate commercial terms, but the advice is sound either way.
What Microsoft keeps by default
Before you shop for a Microsoft 365 backup, know what the service already keeps and for how long:
| What was lost | Default window | What happens after |
|---|---|---|
| Email removed from Deleted Items | 14 days (admins can raise it to 30) | Purged, unless a hold applies |
| Deleted user account (and its mailbox) | 30 days | Account and mailbox permanently deleted, unless a hold was applied first |
| Exchange license removed from a user | 30 days | Mailbox data deleted and can’t be recovered |
| File deleted in SharePoint or OneDrive | 93 days across both recycle bin stages | Permanently deleted |
| A deleted user’s OneDrive | 30 days (admins can set 30 to 3,650 days) | Moves to the site collection recycle bin for 93 days; restore needs PowerShell |
| A whole OneDrive damaged by bad changes | “Restore your OneDrive”: any point in the last 30 days | This feature can’t go back further |
Two details catch people out. Removing a license doesn’t start OneDrive cleanup, but an unlicensed OneDrive is moved to a paid archive on its 93rd unlicensed day. And retention policies take priority over the normal OneDrive process, so content can be deleted sooner or kept longer than the defaults above.
Retention and holds are not a Microsoft 365 backup
Litigation hold preserves deleted items and the original versions of edited items. That is valuable for legal and compliance work. Microsoft’s Backup FAQ notes that holds are “optimized for export (for example, via eDiscovery), not for mass restore.” You can prove an email existed. Putting 5,000 files back where they were, as they were last Tuesday, is a different job.
Version history lets a user roll back one file. Microsoft points out that this doesn’t scale when an admin has to recover a large ransomware incident, and versions can run out depending on the version limit.
Recycle bins only help if someone notices in time. A file deleted quietly in January is gone by May.
The test: a Microsoft 365 backup lets you choose a date and time before the damage and put mail, files, or a whole site back as they were at that moment. If a tool can’t do that, it’s retention, not backup.
Three common ways data goes missing
1. A user is deleted, or a license is removed
Offboarding usually goes like this: license removed, account deleted, done. That starts a 30-day clock on the mailbox. Microsoft’s guidance on inactive mailboxes is to apply a retention policy or hold before deleting the account. Then confirm the hold is actually applied, or the mailbox won’t be kept.
2. Ransomware or a bad sync overwrites OneDrive files
When ransomware or a misbehaving sync tool rewrites files on a laptop, the OneDrive client uploads those changes like any other edit. “Restore your OneDrive” can roll one person’s OneDrive back up to 30 days. That helps for one user who reports the problem quickly. It’s harder across dozens of accounts, for shared SharePoint libraries, or when nobody notices for five weeks.
3. A departed employee’s mailbox and OneDrive
By default, the manager of a deleted user gets access to that person’s OneDrive and receives emails warning before it’s deleted. If no manager is set in Entra ID and no secondary owner is configured in SharePoint, nobody gets access or warnings. Set a secondary owner, and decide how long former employees’ data must be kept before you need it.
Microsoft 365 Backup: Microsoft’s paid option
Microsoft sells its own product, Microsoft 365 Backup, covering OneDrive, SharePoint, and Exchange. From Microsoft’s documentation:
- Price: pay-as-you-go at a list price of $0.15 per GB per month of protected content. Restores are free.
- Restore points: every 10 minutes for the last two weeks on OneDrive and SharePoint, then weekly. Exchange has a 10-minute recovery point.
- How far back: set per policy to 3 months, 6 months, 1 year, or 2 years.
- What you can restore: full OneDrive accounts and SharePoint sites rolled back to a prior point, plus full-mailbox or single-item Exchange restores.
- Where it lives: backup data stays inside the Microsoft 365 boundary.
Third-party Microsoft 365 backup services exist as well, and some keep a copy outside Microsoft’s cloud. Whichever you choose, judge it by the restore test below, not the feature list.
What a restore test should prove
Run these checks against whatever Microsoft 365 backup you rely on, including the built-in tools:
- Point in time: you can pick a moment before the damage, not just “latest.”
- Granular restore: one email, one file, and one folder come back to the right place with the right permissions.
- Full restore: a whole mailbox, a whole OneDrive, and a SharePoint site can be rolled back.
- Former employees: you can recover data for someone deleted more than 30 days ago.
- Time: you wrote down how long each restore took and compared it with how long the business can wait.
- People: more than one person knows how to run a restore, has the right admin role, and signs in with MFA.
Write down the results and repeat the test on a schedule. A backup nobody has restored from is still an assumption.
How LTS can help
We help you find out what your tenant can actually recover today, then close the gaps.
- Microsoft 365 backup review: We map your retention settings, holds, recycle bin windows, and OneDrive offboarding settings against what you’d need after a bad day.
- Backup setup: We set up Microsoft 365 Backup or another backup service, with policies that match how long you need to keep data.
- Restore testing: We run scheduled test restores and keep a written record of what came back and how long it took. This is part of our business continuity work.
- Offboarding that keeps data: Holds, secondary owners, and a checklist so a departed employee’s mail and files aren’t lost when the license goes.
- Ongoing administration: Tenant management through our Microsoft 365 services and managed IT support.
Not sure what you could restore right now? Request a review of your Microsoft 365 recovery setup.
Related: Microsoft 365 services · Business continuity · Managed IT support · Contact