A lot of businesses assume that because their email and files are “in the cloud”, Microsoft is backing them up. Microsoft does a great deal to keep the service available, but recovering your data after a mistake, a malicious leaver or a ransomware attack is largely your responsibility. Here is what Microsoft 365 keeps for you, and where the gaps are.
What Microsoft does look after
Microsoft runs the infrastructure: its data centres, hardware, replication and service availability. If a Microsoft server fails, your data should not disappear. What Microsoft does not do is keep an independent, long-term copy of your data that you can roll back to whenever you like. Most recovery options are time-limited.
How long deleted data is kept by default
- OneDrive and SharePoint files: deleted items stay in the recycle bin for 93 days, then they are gone [1].
- Email: items deleted from Deleted Items are kept in Recoverable Items for 14 days by default. Administrators can increase this to a maximum of 30 days [2].
- Leavers’ OneDrive: when a user is deleted, their OneDrive is kept for 30 days by default (configurable) before it moves to the recycle bin [3]. See what to do before removing a leaver’s licence.
These windows are useful for everyday “I deleted the wrong file” moments. They do not help if nobody notices a problem for four months, if someone deliberately deletes data and empties the recycle bins, or if ransomware encrypts synced files and the sync quietly overwrites good copies.
Retention policies are not the same as backups
Microsoft Purview retention policies can stop content being permanently deleted for a set period. That is valuable for compliance, but it is not designed for fast recovery. Restoring a whole mailbox or SharePoint site to how it looked last Tuesday is slow and awkward with retention alone.
Your options for proper backup
- Microsoft 365 Backup: Microsoft’s own paid backup service for OneDrive, SharePoint and Exchange, charged by the amount of data protected [4].
- Third-party Microsoft 365 backup: independent services that copy your data to separate storage, often with longer retention and item-level restores.
- Either way: make sure backups are protected with multi-factor authentication, and test a restore regularly.
Questions to answer for your business
- How far back would we need to go to recover from a problem nobody noticed straight away?
- How quickly would we need a mailbox or shared folder back?
- Who can delete data, and could a compromised admin account delete the backups too?
- When did we last test a restore?
If the answers worry you, read our guide to how often a business should back up and why backups are not a ransomware plan until they have been tested.
When to speak to BMT
Our managed backup service covers Microsoft 365 mail, OneDrive, SharePoint and Teams, with restores tested on a schedule. If you are not sure what your current setup protects, our Microsoft 365 support team can check. Call us on 0161 672 7461 or 01706 391 047, or get in touch online.
Related reading: OneDrive backup: protecting business data · Don’t pay the ransom: plan your recovery
Sources
[1] Restore deleted items from the site collection recycle bin – Microsoft Learn
[2] Change how long permanently deleted items are kept – Microsoft Learn