Microsoft 365 Is Not a Backup: How Long You Really Have to Recover Deleted Files
“Our files are in Microsoft 365, so they are backed up.” We hear this from almost every new client. It is one of the most expensive misunderstandings in small business IT. Microsoft keeps your data available. It does not keep every version of your data forever, and it will not undo a mistake that happened two months ago.
This guide shows, with Microsoft’s own numbers, exactly how long you have to recover deleted email and files, where the gaps are, and how much backup a small business really needs.
Key takeaways
- Permanently deleted emails in Exchange Online are kept for 14 days by default (30 days maximum).
- Deleted files in SharePoint and OneDrive sit in the recycle bins for up to 93 days, then they are gone.
- Microsoft 365 is built to keep its service running, not to give you a long history of your own business data. That part is your responsibility.
- A proper backup is separate from Microsoft 365, keeps older versions and is tested regularly.
The recovery clock: how long you actually have
| What was deleted | Built-in recovery window | What this means for you |
|---|---|---|
| An email emptied from Deleted Items | 14 days by default, can be raised to 30 (Microsoft) | If nobody notices for three weeks, the email may be unrecoverable. |
| A file deleted from SharePoint or OneDrive | Up to 93 days across the two recycle bins | Fine for quick mistakes, useless for something discovered at year-end. |
| A file overwritten with wrong content | Only if version history is on and the version still exists | Large spreadsheets edited daily can lose older versions quickly. |
| A former employee’s mailbox and OneDrive | Limited time after the licence is removed | Remove a licence too quickly and client emails can disappear with it. |
5 real situations Microsoft 365 alone will not save you from
- The slow discovery. A staff member deletes a client folder in June. Nobody notices until the client calls in October. The recycle bin has already been emptied.
- The departing employee. Someone leaves, their account is deleted to save a licence, and with it go years of client emails nobody exported.
- Ransomware that syncs. An infected laptop encrypts files in a synced OneDrive folder, and the damaged versions sync straight to the cloud.
- The hacked mailbox. A criminal gets into an account and deletes emails to cover their tracks after an invoice fraud attempt.
- The compliance request. A client, insurer or regulator asks for records from three years ago. Clinics and professional offices with retention duties are especially exposed; see our PIPEDA and BC PIPA checklist for clinics.
How much backup is “enough” for a small business?
Use the 3-2-1-1-0 rule. It sounds technical, but it is simple:
- 3 copies of your important data (the live copy plus two backups)
- 2 different types of storage (for example, cloud backup and a local device)
- 1 copy kept off-site
- 1 copy that cannot be changed or deleted (offline or “immutable”), so ransomware cannot touch it
- 0 errors when you test a restore
This lines up with the Canadian Centre for Cyber Security’s baseline controls for small and medium organizations, which recommend regular backups to a secure external location, keeping long-term backups offline and off-site, encrypting all backups and limiting who can access them.
Two questions decide your backup plan
Ask yourself these, and write the answers down:
- How much work can we afford to lose? If losing a full day of invoices and emails would hurt, you need backups at least daily. IT people call this the recovery point.
- How long can we afford to be down? If being offline for two days would cost you clients, you need a way to restore fast, not just a copy stored somewhere. This is the recovery time.
Those two answers determine whether you need simple cloud backup or a full disaster recovery plan with standby systems.
The 20-minute restore test every business should run
Most businesses discover their backup does not work on the worst possible day. Do this instead, once a quarter:
- Pick one real folder and one real mailbox.
- Restore a file from 30 days ago and an email from 60 days ago to a test location.
- Time how long it takes and confirm the files open.
- Write the result down: date, what was tested, how long it took, pass or fail.
If you cannot do steps 2 and 3, you do not have a backup yet. You have a hope.
Quick settings to change today
- Raise deleted-item retention in Exchange Online from 14 to 30 days, the maximum Microsoft allows.
- Before deleting a leaving employee’s account, convert the mailbox to a shared mailbox or export it, and move their OneDrive files to a manager.
- Make sure version history is enabled on important SharePoint libraries.
Frequently asked questions
Does Microsoft back up my Microsoft 365 data?
Microsoft protects its service against hardware failure and outages, and gives you recycle bins and limited retention. It does not provide long-term, point-in-time backups of your business data that you control. Most businesses add a separate Microsoft 365 backup service.
How long are deleted emails kept in Microsoft 365?
Permanently deleted items stay in the Recoverable Items folder for 14 days by default, adjustable up to 30 days, unless a hold or retention policy applies.
Is an external hard drive a good enough backup?
It is better than nothing, but a single drive kept in the office can be stolen, fail or be encrypted by ransomware if it stays plugged in. Combine it with an off-site cloud backup.
Could you restore last month’s files today?
Book a free IT assessment. We will check your Microsoft 365 retention, test a real restore and show you where your data is not protected.
Insmart Technology provides data backup and recovery, Microsoft 365 services and managed IT for businesses across Surrey and the Lower Mainland.
Related reading: if a laptop or external drive has failed, read what to do first when a hard drive or SSD fails.
About the author: Naqash Bin Iqbal is an SEO Specialist at Insmart Technology, a Surrey-based managed IT and cybersecurity provider.
