What Microsoft 365 backs up for you, and what it does not

Most of the tenants we review have no Microsoft 365 backup at all. The IT manager assumes Microsoft keeps a copy. Microsoft assumes you do. Both are reading the same contract and seeing different things.

Microsoft's own shared responsibility documentation settles it. For every cloud model, including software as a service, Microsoft states that "You're responsible for your data, including data classification, data protection, encryption decisions, and compliance with data governance requirements." Microsoft runs the service and keeps it available. Getting your mail and files back after someone deletes them, or encrypts them, is your job.

What you get by default is retention, and retention is a timer. Here is where each one runs out.

What native Microsoft 365 retention actually gives you

The platform does give you several ways to undo a mistake. Know them before you pay for anything else.

Exchange Online. When a user empties Deleted Items or uses Shift+Delete, the message lands in the Recoverable Items folder. By default it stays there for 14 days. You can raise that to a maximum of 30 days per mailbox with Set-Mailbox -RetainDeletedItemsFor 30. Note that this command only touches existing mailboxes; new ones need the mailbox plan changed as well, or they come up at 14 again.

SharePoint and OneDrive. A deleted file sits in the recycle bin for 93 days, counted from the original deletion. Emptying the first-stage bin moves it to the second-stage bin for whatever is left of those 93 days. It does not restart the clock. A deleted site is also retained for 93 days. Microsoft keeps its own backups for a further 14 days after that, but only Microsoft support can use them, and only for a point-in-time restore of a whole site.

OneDrive Files Restore. Each user's OneDrive can be rolled back to any point in the last 30 days. Microsoft documents this as the tool for undoing ransomware, with the restore page pre-filling a suggested date when its detection fires. It cannot bring back anything already purged from the recycle bin.

Deleted users. Delete a user and Exchange Online keeps the mailbox in a soft-deleted state for 30 days. After that the mailbox is purged and cannot be recovered. The user's OneDrive is kept for the number of days set in the SharePoint admin center (Settings, then Retention), with a floor of 30 days and a ceiling of 3,650. The same 30-day grace applies when you remove a license: re-license inside the window and the mailbox comes back whole, miss it and the data is gone.

Each of these is useful when someone deleted the wrong folder yesterday. None of them is a backup.

Where retention falls short, and how to tell if that includes you

Four situations show up repeatedly. Check which apply to your tenant.

Ransomware on a synced library. Most companies sync SharePoint libraries to local disks through the OneDrive client. When ransomware encrypts the local copies, the changes are synced up as new versions, the same way any edit would be. Files Restore can roll a single user's OneDrive back 30 days. For a SharePoint library shared by 80 people, you are restoring versions file by file, or restoring an entire site through Microsoft support. Microsoft's own Microsoft 365 Backup documentation says plainly that versioning and legal holds do not scale well for large-scale ransomware recovery.

Departed users. The common offboarding sequence is: remove the license to save money, convert nothing, delete the account a few weeks later. Thirty days after the license comes off, the mailbox is unrecoverable. The only native way to keep a former employee's mail indefinitely is to put the mailbox under a retention policy or litigation hold before deleting the account, which turns it into an inactive mailbox. If nobody applied the hold first, there is no inactive mailbox and no copy.

The retention window is shorter than the discovery window. A finance user notices in March that a contract folder was cleared out in November. At 93 days, SharePoint has already purged it. Retention is measured from deletion, not from the moment someone notices.

A compliance hold is not a backup. Purview retention policies keep copies of deleted and edited items in Recoverable Items, which Microsoft describes as retention "for compliance purposes." Only staff with eDiscovery permissions can see those copies. A hold answers "can we prove what this mailbox contained"; it does not answer "can we put 400 mailboxes back the way they were at 6:00 a.m. yesterday." It also lives in the same tenant as the data it protects, so an attacker with Global Administrator rights can remove the policy and the protection with it.

What it costs when the timer runs out

The cost is rarely the data itself. It is what the data was holding up.

A purged mailbox becomes a legal and HR problem when a former employee's correspondence is requested in a dispute. A SharePoint library encrypted over a long weekend means the company runs on paper until someone finishes a version-by-version restore. A cyber-insurance questionnaire that asks whether backups are offsite, immutable, and tested gets an honest "no," and the renewal is priced accordingly.

Microsoft's consumer Services Agreement states it directly: "We strongly advise you to make regular back-up copies of Your Content." That agreement governs Microsoft's consumer services rather than business tenants, but read alongside the shared responsibility model above, Microsoft's position on whose job this is comes through clearly.

What a real Microsoft 365 backup design includes

For a company of 50 to 500 people, we design to four requirements. Pick a product second; get these right first.

1. A copy outside the tenant, outside the admin's reach. The backup must survive a compromised Global Administrator account. That means storage the tenant's credentials cannot delete, and a backup service account with its own MFA that no one uses for anything else.

2. Immutability for longer than your detection window. Backups should be write-once for a defined period so ransomware or a malicious insider cannot overwrite history. Microsoft 365 Backup, Microsoft's own paid add-on, uses append-only storage and keeps restore points every ten minutes with recovery windows of three months to two years, billed per gigabyte protected. It is a reasonable first layer. Its limit is the one named above: it runs inside the same Microsoft 365 service as the data, and its documentation notes that deletion of backups is still permitted so that customers can offboard. Pair it with an external copy if a tenant-level compromise is in your threat model.

3. Retention measured in years for mail, not days. Set mailbox and OneDrive retention to the longest period your records policy and your counsel require. Then set the offboarding runbook so that every departing user's mailbox is backed up and, if the business needs it, made inactive under a hold before the license is removed.

4. Restores you have actually run. Schedule a quarterly test: restore a single mailbox to a new user, restore a SharePoint library to a point in time, and restore a departed user's OneDrive. Time each one and write the times down. A backup that has never been restored is an assumption.

Do these in order. Raise RetainDeletedItemsFor to 30 today; it is free. Fix offboarding this week. Then size the backup.

Microsoft 365 backup is one part of our backup and disaster recovery work, alongside the tenant hardening under cloud services.

When to get help

If you cannot say today where a copy of your mail and SharePoint data lives outside the tenant, or your last restore test was never, it is time for a 30-minute intro call. We will walk through your retention settings and offboarding process and tell you what to fix first. Book it at padlocktech.com/#contact.