Quick answer: Not in the way most owners assume. Microsoft keeps its service running, but deleted email and files are recoverable only for a limited time (roughly two to four weeks for email and up to about three months for files), and Microsoft itself recommends that you back up your own content. A separate Microsoft 365 backup closes that gap.
Most small businesses move to Microsoft 365 and quietly assume “in the cloud” means “backed up”. Then an employee deletes a shared folder, a departing user wipes a mailbox, or ransomware syncs encrypted files to OneDrive, and someone discovers the recovery window has closed.
This guide explains what Microsoft 365 backup does and does not cover, shows the real Microsoft 365 data retention numbers from Microsoft’s own documentation, and walks you through a simple Microsoft 365 backup plan to close the gap.
Microsoft 365 uptime is not the same as Microsoft 365 backup
Microsoft is responsible for keeping the platform running: servers, networks and data centers. You are responsible for your data: who can delete it, how long you keep it, and how you get it back after a mistake or attack.
The Microsoft Services Agreement says so explicitly: “We recommend that you regularly backup Your Content and Data” (Microsoft Services Agreement, section 6).
What you get built in is recovery from recent deletions, not long-term backup.
Microsoft 365 data retention: what Microsoft keeps after you hit delete
| Item | What Microsoft provides | Source |
|---|---|---|
| Exchange Online (email) deleted items | 14 days by default, up to 30 days if an admin changes it | Microsoft Learn |
| SharePoint recycle bins | 93 days in total across both recycle bin stages, then permanently deleted | Microsoft Learn |
| SharePoint support-assisted restore | Microsoft keeps backups for 14 more days after deletion for a point-in-time restore through support | Microsoft Learn |
| OneDrive Files Restore | Restore a whole OneDrive to any point in the past 30 days | Microsoft Learn |
Notice what is missing: nothing here covers a file you only discover is gone after three months, the mailbox of a former employee, or a long-running ransomware infection that quietly changed data over weeks.
Settings and licenses change, so check your own tenant. Admins can extend some retention periods, but that is retention, not backup.
Four ways businesses lose Microsoft 365 data
1. Accidental or deliberate deletion
A staff member empties a recycle bin, or a departing user deletes files on the way out. Once the window passes, the data is gone for good.
2. Ransomware that follows your files into OneDrive
When an infected laptop uploads encrypted files, OneDrive treats them as normal edits and the clean copies are replaced. Version history is not a OneDrive backup. It can roll some files back, but only within its limits, and an attacker with admin rights can delete those versions too.
3. Compromised accounts
A phished password can let an attacker delete mail, files and sites. Strong multi-factor authentication and email security are the first line of defense, and it is also why insurers ask about it. Attackers increasingly use AI-powered phishing and deepfake scams to steal those logins.
4. Departed employees and removed licenses
When a license is removed, the mailbox and OneDrive can be deleted after a retention period. Microsoft’s own agreement warns that it may be unable to retrieve your content after an account closes.
What a proper Microsoft 365 backup should include
A proper backup is a separate copy, stored outside your Microsoft tenant, that you control. Look for:
- Coverage: Exchange mailboxes, OneDrive, SharePoint sites, and Teams files as supported by your backup tool
- Automatic daily backups (more often if your recovery point target requires it)
- Long retention: months or years, not days
- Granular restore: one email, one file or one site, not only a full rollback
- Protection from deletion: immutable or access-controlled storage, so a compromised admin account cannot erase the backups
- Tested restores: proof it works, not only a green checkmark. Monitored backups with daily job checks catch failures before you need the data.
This follows the same principles as any recovery plan: set your recovery time and recovery point targets, keep an offline or immutable copy, and test regularly.
Quick self-check: is your Microsoft 365 backup in place?
| Question | Ready? |
|---|---|
| Do we have a backup stored outside Microsoft 365? | Yes / No |
| Does it cover email, OneDrive and SharePoint? | Yes / No |
| Can we keep data longer than 93 days? | Yes / No |
| Have we restored a real file or mailbox in the last six months? | Yes / No |
| Is MFA on for every account, especially admins? | Yes / No |
| Do we have a process for departing employees’ data? | Yes / No |
If you answered “No” to two or more, you have a gap worth closing before it costs you.
Common Microsoft 365 backup mistakes to avoid
- Treating OneDrive sync as a backup. Sync mirrors deletions and encryption.
- Relying on the recycle bin. It is a convenience feature with a time limit.
- Backing up only email. Files, sites and shared mailboxes matter too.
- Never testing a restore. Try recovering a file and a mailbox item on a schedule.
- Forgetting departing staff. Decide what to keep before removing the license.
How we help with Microsoft 365 backup in Turlock
Our cloud services team manages Microsoft 365 for local organizations, and our backup and disaster recovery services add a separate, monitored backup with restore testing. Both are part of the planning and monitoring included in our managed IT services for businesses across Turlock, Modesto, Ceres, Merced and the Central Valley.
Frequently asked questions
Does Microsoft 365 back up my data?
Microsoft keeps the service available and lets you recover recently deleted items for a limited time, but it recommends that you back up your own content and data. A separate backup protects you beyond those windows.
How long does Microsoft 365 keep deleted emails?
Exchange Online keeps deleted items for 14 days by default, and an admin can increase this to a maximum of 30 days.
How long are deleted SharePoint files kept?
Deleted SharePoint items stay in the recycle bins for 93 days in total. After that they are permanently deleted, apart from a short extra period during which Microsoft support may be able to perform a restore.
Is OneDrive a backup?
No. OneDrive syncs files across devices, so deletions and ransomware encryption can sync too. It has version history and a 30-day restore option, but that is not a long-term backup.
Do I need a separate Microsoft 365 backup if I have an IT provider?
It depends on what your provider has set up. Ask whether backups are stored outside Microsoft 365, how long they are kept, and when a restore was last tested.
Who can set up Microsoft 365 backup in Turlock?
A local managed IT provider can configure and monitor the backup and test restores. VaultEdge IT offers a free consultation for businesses in Turlock and the surrounding Central Valley.
Get a free Microsoft 365 backup check
Not sure what is protected today? Our team will review your Microsoft 365 setup, show you your current recovery windows and recommend the simplest way to close any gaps, with no obligation.
Schedule Free IT Assessment · Call +1-916-516-1202 · support@vaultedgeit.com