An employee leaves in March. Their account is deleted the same week, which is the right thing to do. In June, a client asks for the proposal that employee wrote. Their OneDrive was kept for 30 days after the deletion, which is Microsoft’s default, and it is gone.
Nobody did anything wrong. Nothing was backed up, because everyone assumed Microsoft was doing it. This is the most common version of the question in the title, and the answer is more specific than yes or no.
What Microsoft actually promises
Microsoft promises to keep the service running. It copies your data across multiple data centers so that a disk or a building failing on its side never loses anything. It publishes uptime commitments and pays credits when it misses them.
What it does not promise is to get your data back when the loss happened on your side: a deletion, an offboarding, a ransomware infection that synced up from a laptop, an administrator who clicked the wrong thing. Under what Microsoft calls the shared responsibility model, the service is theirs to keep online and the contents are yours to protect. Its own Services Agreement says it plainly: it recommends that you regularly back up your content and data.
The distinction that trips people up is replication versus backup. Replication copies a change everywhere, instantly and faithfully. When the change is a deletion, the deletion is replicated too. A backup is a separate copy from an earlier point in time that the change never reached.
The built-in windows, in plain English
Microsoft does give you safety nets. They are for the mistake you notice this month, and it helps to know exactly how long each one lasts. The figures below are Microsoft’s published defaults for business tenants; an administrator can lengthen some of them, and most small companies never have.
- A deleted email sits in the Deleted Items folder until someone empties it. After that it moves to a hidden recoverable area for 14 days by default, which an administrator can raise to 30. Then it is gone.
- A deleted mailbox, the departed employee case, is kept for 30 days and then permanently removed, unless someone preserved it first by converting it to a shared mailbox or applying a retention policy.
- A deleted file in SharePoint or Teams goes through a two-stage recycle bin and is recoverable for 93 days in total from the day it was deleted.
- A deleted file in OneDrive follows the same 93-day path. The whole OneDrive of a deleted user is a different case: it is kept for 30 days by default after the account goes, and an administrator can set that anywhere up to ten years.
- Teams chat messages are stored in the participants’ mailboxes, so they follow the mailbox rules above.
Write those numbers down somewhere. They are the answer to “how long do we have” for the ordinary mistakes, and they are shorter than most people assume.
What the windows do not cover
The recovery windows are designed for a person who deleted something and wants it back soon. They are not designed for the situations that actually threaten a business.
Ransomware that came in through one laptop. A machine gets infected, the malware encrypts the files on it, and the sync client dutifully uploads the encrypted versions to SharePoint and OneDrive, where they replace the good ones. Version history helps for a handful of files. It does not help for a few thousand, and an attacker who has the account can delete versions too.
An attacker with administrator rights. Someone who has stolen an admin password can empty recycle bins, shorten retention, and delete accounts. Everything in the previous section assumes the person holding the controls is on your side.
Anything older than the window. The proposal from the employee who left in March. The version of the client contract from before the edit nobody can explain. The mailbox of the finance manager who left last year, which the auditor now wants.
A deletion done on purpose, quickly. Offboarding is supposed to be fast, and our guide on company devices and personal phones says so. Fast and irreversible is a bad combination unless a copy exists somewhere the offboarding does not touch.
A retention policy nobody checked. Policies configured years ago by a previous provider, applying to some sites and not others, are common. The policy is not wrong; it is just not what anyone thinks it is.
“Microsoft is down” is a different problem
Twice in three weeks this September, Microsoft 365 itself was the problem. On August 31, 2026 an authentication fault in Exchange Online took out mail for many hours and spilled into Teams, SharePoint, OneDrive, and the admin center, with degraded service still being reported the next day. From September 16 to 19 a second suite-wide degradation followed.
No backup fixes an outage; your data was fine both times. What fixes an outage is a one-page plan: a contact list that does not live in Outlook, a second way to reach each other, a named person who tells clients what is happening, and an agreement on when to send people home. Keep the two problems separate in your head. Backup is for when the data is gone. Continuity planning is for when the data is fine and nobody can reach it. A company needs both, and the second one costs nothing but an hour.
What a real backup of Microsoft 365 is
A backup, as opposed to a recovery window, has five properties:
- It is independent. The copy lives outside your tenant, so a deletion, an attacker, or a misconfiguration inside the tenant cannot reach it.
- It is scheduled. Copies are taken daily, or more often, without anyone remembering to do it.
- It restores from a point in time. You can bring back a mailbox, a folder, or a whole site as it was on a particular day, not just the most recent version of one file.
- It keeps what you decide. Retention is set by your business needs, often years, not by a default someone else chose.
- It has been tested. Someone has actually restored something from it and confirmed the result opens.
There are two routes to that. Microsoft now sells its own Microsoft 365 Backup service, priced per gigabyte, which covers Exchange, OneDrive, and SharePoint. Independent backup services do the same job from outside Microsoft’s estate, which some businesses and insurers prefer. Either is a reasonable choice. The unreasonable choice is the one most small companies have made without knowing it, which is neither.
What a well-run Microsoft 365 backup looks like
- Someone can name the product that backs up mail, OneDrive, SharePoint, and Teams, and say when it last ran.
- The copies live outside the tenant, and an attacker with an admin password could not delete them.
- Retention is a decision, written down, that matches how long clients, regulators, and your own records need.
- Departed employees’ data is captured before the account is deleted, as a step in the offboarding checklist.
- A restore has been tested in the last quarter, and the result is written down, including how long it took.
- The outage plan exists as a separate page, because a backup will not help on the day Microsoft is down.
Where this leaves you
Two questions for this week. “If we had deleted a mailbox in March, could we read it today?” and “When did anyone last restore something from our backup to prove it works?” If the first answer is “I assume so” and the second is silence, you have your finding, and it is the most common one we see.
Setting up independent copies of Microsoft 365, holding them where an attacker cannot reach them, and restoring from them every quarter to prove it is what our backup and disaster recovery service does. If the tenant’s own retention settings are the mystery, that is a Microsoft 365 management question. Get in touch and we will start with what you have now.