Microsoft keeps Microsoft 365 running, but protecting your data is your job. Its built-in safety nets are short: deleted email is recoverable for 14 days by default (30 at most), SharePoint and OneDrive files for 93 days, and a leaver's OneDrive for 30 days unless you change it. After that, it's gone. A proper backup copies mailboxes, OneDrive, SharePoint and Teams to a separate system several times a day, keeps copies for years, and is tested with real restores.
What does Microsoft actually look after?
Microsoft runs the data centres, the servers, the network and the software. It keeps the service available and it keeps several copies of your data so that a failed disk in one of its buildings doesn't lose your email.
What it doesn't do is protect you from yourself, your staff or an attacker who signs in as one of them. Microsoft's own shared responsibility model is clear: for every type of cloud service, including software like Microsoft 365, "you own your data and identities" and you're responsible for protecting them (Microsoft Learn). If someone deletes a folder, a synced laptop overwrites good files with encrypted ones, or a leaver's account is removed, Microsoft's systems do exactly what they were told.
That's the gap. Microsoft protects the service. It doesn't give you a separate, long-term copy you control.
How long does Microsoft keep deleted data?
Microsoft 365 has recycle bins and retention settings, and they're useful for everyday mistakes. They're not a backup, because they sit in the same system, run on fixed clocks and can be emptied by anyone with enough access.
| What's deleted | How long it's recoverable by default | Where it goes after that |
|---|---|---|
| An email, calendar entry or contact | 14 days in Recoverable Items, which an admin can raise to 30 days | Permanently removed |
| A file in SharePoint or OneDrive | 93 days across the two recycle bin stages | Permanently removed. Microsoft keeps its own backup for a further 14 days, restorable only as a whole site through Microsoft Support |
| A leaver's whole OneDrive | 30 days after the account is deleted, which an admin can extend | Moved to the recycle bin for 93 days, then gone |
| A Teams chat or channel conversation | Depends on your retention policies | Removed if no policy holds it |
Retention policies in Microsoft Purview can hold data for longer. They're designed for compliance, though, not quick recovery. Getting a single file back from a retention hold means an eDiscovery search (a formal search built for legal and audit requests), and an attacker with admin rights can change the policy.
What goes wrong without a backup?
These are the situations we see most often, and none of them is a Microsoft fault.
A leaver's files disappear. The account is deleted in March. Nobody checks the OneDrive. In June, finance needs a spreadsheet only that person had. The 30-day window closed months ago. Our article on what should happen to a leaver's email, files and phone number covers the process that prevents this, and a backup is the safety net if a step gets missed.
Ransomware reaches OneDrive. A laptop is infected and encrypts every file it can reach, including the synced OneDrive and SharePoint libraries. OneDrive's version history can roll back, but only if the attacker hasn't also deleted versions, and only for files that still exist. Our article on how ransomware gets in and how to recover without paying explains the full picture.
An attacker deletes on purpose. Someone who takes over an admin account can empty recycle bins, delete mailboxes and change retention settings. The NCSC's principles for ransomware-resistant cloud backups exist because of exactly this: backups should survive "destructive actions", let you restore from earlier versions, and alert you when privileged changes are made (NCSC, November 2024).
Someone notices too late. A mailbox folder deleted in error in summer is needed for a dispute in November. The 14 days ran out long ago.
What should a Microsoft 365 backup cover?
A proper backup is a separate service that connects to your Microsoft tenant (your organisation's Microsoft 365 account), copies everything on a schedule and keeps it somewhere an attacker inside that account can't reach. Use this checklist when you compare products.
- Everything, not just email. Exchange mailboxes (including shared mailboxes and calendars), OneDrive, SharePoint sites and Teams, including channel messages and files.
- Several times a day. Datto SaaS Protection, for example, backs up three times a day. A nightly copy can lose a full working day.
- Separate from Microsoft 365. Stored outside your tenant, with its own sign-in and MFA, so a compromised Microsoft 365 admin account can't delete the backups.
- Kept long enough. At least as long as your longest legal or contractual need. Many businesses choose years, not months.
- Point-in-time restore. Put a mailbox or a whole site back to how it was before the ransomware hit, not just the latest copy.
- Granular restore. One email, one file or one folder, back to the original place, without disturbing anything else.
- Leavers kept. Backups of a leaver's mailbox and OneDrive should survive after you remove their licence.
- Alerts and reports. Someone gets told when a backup fails, and the report is read.
Microsoft now sells its own service too. Microsoft 365 Backup is pay-as-you-go at $0.15 per GB of protected content per month (Microsoft Learn, US dollar pricing). It offers fast restores, but it runs inside Microsoft's own cloud and is billed through your tenant, so check how well it fits the NCSC's separation principles before relying on it alone.
Worked example: a 25-person office
Example (an illustration, not a real client): a 25-person professional services firm in Glasgow keeps all its files in SharePoint and OneDrive and has never set up a separate backup.
On a Thursday afternoon, a staff member opens a fake invoice attachment. By Friday morning, 14,000 files in the client folders have been encrypted and renamed, and the changes have synced to everyone's laptops.
Without a backup. The firm relies on version history, restoring folder by folder. Some files restore cleanly. Others had versions deleted. It takes most of the following week and some client work has to be recreated.
With a backup. The IT team isolates the laptop, resets the account and restores the affected SharePoint library to its state at Thursday lunchtime, from a backup taken three times a day and stored outside the tenant. Staff lose a few hours of edits, not a week.
The backup costs a monthly per-user charge. Not having one costs days of work.
How do you know your backup works?
A backup nobody has tested is a hope, not a plan. Build three habits.
- Test a restore every quarter. Pick a real mailbox folder and a SharePoint folder and restore them to a test location. Time it.
- Read the failure reports. A backup that has quietly stopped for one user, often a new starter who was never added, is common.
- Check scope when things change. New SharePoint sites, new Teams and new shared mailboxes need to be included. Good products pick them up automatically. Check that yours does.
Record the result of each test. Insurers increasingly ask whether backups are tested, and "yes, last done on this date" is a much better answer than "we think so".
How Indigo does this. Indigo Unified Communications is a Microsoft Solutions Partner for AI Business Solutions and has completed 100+ Microsoft 365 migrations. We back up Microsoft 365 with Datto SaaS Protection, part of the Kaseya 365 stack we run for managed IT clients, covering Exchange, OneDrive, SharePoint and Teams. Our Glasgow service desk handles restore requests like any other ticket, with every ticket getting a first response in under 30 minutes. Managed IT support → Microsoft 365 backup (Datto SaaS Protection) is included as standard on our Gold, Platinum and Charity packages and available as an add-on on Silver, with unlimited retention and backups stored in UK data centres.
What to do next
- Check your deleted item retention in Exchange Online and raise it to the maximum 30 days. It costs nothing.
- Check your OneDrive retention for deleted users. The default is 30 days. Extend it so leavers' files aren't lost before anyone looks.
- Find out whether you have a separate backup and what it covers. Ask for the last restore test date.
- Add backup checks to your leaver process, so mailboxes and OneDrive are kept before the licence is removed.
- Book a free IT health check and we'll review your Microsoft 365 backup, retention and restore process as part of it.
Frequently asked questions
Does Microsoft back up my Microsoft 365 data?
Microsoft keeps copies of your data so its service stays available, and it has recycle bins for recent deletions. It doesn't give you a separate, long-term backup you control. Deleted email is recoverable for 14 days by default, files for 93 days. Under Microsoft's shared responsibility model, protecting your data is your responsibility.
How long can I recover deleted emails in Microsoft 365?
By default, 14 days after they're removed from Deleted Items, in the Recoverable Items folder. An admin can raise this to a maximum of 30 days per mailbox. After that, the email is permanently removed unless a retention policy or a separate backup holds it. Calendar items follow different rules.
What happens to a leaver's OneDrive files?
When you delete the user's account, their OneDrive is kept for 30 days by default, and their manager is emailed about access. After that it moves to the recycle bin for 93 days and is then deleted. Admins can extend the 30-day period. Move files you need to SharePoint before removing the licence.
Is Microsoft 365 Backup enough on its own?
It's Microsoft's own paid backup, charged per GB of protected content, with fast restores. It runs inside Microsoft's cloud, so it doesn't give you a copy with a different supplier. Many businesses prefer a third-party backup stored outside the tenant, in line with the NCSC's principles for ransomware-resistant cloud backups.
Sources: Microsoft Learn, Shared responsibility in the cloud, accessed September 2026 (https://learn.microsoft.com/azure/security/fundamentals/shared-responsibility) · Microsoft Learn, Recoverable Items folder in Exchange Online, accessed September 2026 (https://learn.microsoft.com/exchange/security-and-compliance/recoverable-items-folder/recoverable-items-folder) · Microsoft Support, Restore deleted items from the site collection recycle bin, accessed September 2026 (https://support.microsoft.com/en-us/office/restore-deleted-items-from-the-site-collection-recycle-bin-5fa924ee-16d7-487b-9a0a-021b9062d14b) · Microsoft Learn, OneDrive retention and deletion, accessed September 2026 (https://learn.microsoft.com/sharepoint/retention-and-deletion) · Microsoft Learn, Microsoft 365 Backup pricing, accessed September 2026 (https://learn.microsoft.com/microsoft-365/backup/backup-pricing) · NCSC, Principles for ransomware-resistant cloud backups, 22 November 2024 (https://www.ncsc.gov.uk/collection/ransomware-resistant-backups/principles-for-ransomware-resistant-cloud-backups) · Datto, Microsoft 365 backup: SaaS Protection, accessed September 2026 (https://www.datto.com/products/saas-protection/microsoft-365-backup/)
Related: What should happen to a leaver's email, files and phone number? · How ransomware gets in, and how to recover · How to save money on Microsoft 365 licences · Managed IT support · Cyber security
Get a free technology assessment
One of our consultants will review your IT, security, connectivity and phones, then give you practical recommendations. No obligation.