Short answer
No, not in the way most people mean. Microsoft keeps its service running and holds on to deleted email and files for a limited time: usually 14 to 93 days, depending on what was deleted and how. After that they're gone for good. Microsoft's own documentation is clear that your data is your responsibility. If you need to get something back from further back than that window, or after someone deliberately deleted it, you need a separate backup.
What Microsoft actually says
Microsoft works on a "shared responsibility" model. It looks after the data centres, the hardware and keeping the service online. You look after your data and who can get to it. Its documentation puts it plainly: "For all cloud deployment types, you own your data and identities."
Microsoft now sells its own backup product for Microsoft 365. Its FAQ asks whether that changes the shared-responsibility stance, and answers "No." It also points out that the copies Microsoft keeps for disaster recovery hold the current state of your content, not the older versions you would need after a mistake.
So there's a copy in case Microsoft loses a data centre, but not one for when you lose something.
How long Microsoft keeps deleted things
These are Microsoft's default settings for Business Basic, Standard and Premium. Your tenant may be different if someone has set up retention policies.
| What was deleted | How long you can get it back | Worth knowing |
|---|---|---|
| An email (sitting in Deleted Items) | Until someone empties the folder | By default nothing empties Deleted Items automatically, so it's safe until a person clears it. |
| An email deleted from Deleted Items | 14 days (an admin can raise this to 30) | If the user deliberately purges it, only an admin can recover it, and only within the same window. |
| A file in OneDrive or SharePoint | 93 days in the recycle bin | Once it's removed from the recycle bin, Microsoft says it "can never be recovered". |
| A whole OneDrive or document library, rolled back | Any point in the last 30 days | Microsoft's "Restore your OneDrive" tool. It's the one that helps after ransomware, but only if you notice within 30 days. |
| Old versions of a file | Up to 500 versions | Older versions are trimmed as new ones are saved, and trimmed versions can't be recovered from the recycle bin. |
| A deleted staff account's mailbox | 30 days | Also 30 days if you just remove their licence. After that it's deleted and can't be recovered. |
| A deleted staff account's OneDrive | 30 days by default (adjustable) | Their manager gets access automatically. After that it sits in a recycle bin an admin can restore from for another 93 days. |
| A SharePoint site | 93 days | For sites attached to a Team, the team's other parts (like its mailbox) are kept for only 30 days. |
| A Teams channel | 21 days | Chats have no recycle bin. A deleted team can be restored for 30 days. |
From Microsoft's documentation, checked 18 September 2026. Microsoft does change these settings, so check the sources below if you're relying on a specific number.
Where it goes wrong in real life
These windows cover most day-to-day accidents. They fail in a predictable set of situations, and small businesses hit every one of them:
Ransomware you notice late
If a laptop is infected and it quietly encrypts files that sync to OneDrive, you have 30 days to roll back. Ransomware that sits unnoticed for a while, or an attack found only when someone opens an old folder, falls outside that window.
A departing employee cleans up on the way out
An unhappy staff member deletes their email and purges it. The user can't get it back after that, and even an admin has only 14 days by default. If nobody notices until a client asks about an old conversation weeks later, it's gone, unless a hold or retention policy was set up before it happened.
"We'll just keep their account unlicensed"
Removing a leaver's licence to save money feels like archiving them. It isn't. Their mailbox is deleted after 30 days. Their OneDrive becomes read-only after 60 unlicensed days and is archived after 93, and Microsoft now charges to store archived OneDrives and to bring them back. Leaving accounts unlicensed has stopped being a free way to keep old data.
A file that's been overwritten too many times
A spreadsheet that's saved constantly can burn through its version history. If the good version is older than the last 500 saves, it's no longer there.
The admin account itself is compromised
An attacker, or an angry ex-administrator, with admin access can permanently delete mailboxes, sites and recycle bin contents. Every protection above assumes whoever deletes things is on your side.
The subscription lapses
If the card on the Microsoft account expires and nobody notices, the subscription moves from expired (30 days) to disabled (90 days, admins only), and then the data is deleted.
What a real backup looks like
A proper Microsoft 365 backup copies your email, OneDrive and SharePoint to storage that's separate from your day-to-day admin access, keeps restore points going back months or years, and can be restored from without relying on the recycle bin. There are two broad options:
- Microsoft 365 Backup, Microsoft's own product. It covers Exchange, OneDrive and SharePoint, with a list price of US$0.15 per GB per month of protected content. It needs an Azure subscription set up for billing. Microsoft doesn't list Teams chats as covered.
- A third-party backup service that stores copies outside your Microsoft tenant entirely. These are usually priced per user, and many also back up Teams.
Whichever you use, what matters most is the part most businesses skip: test a restore. A backup that has never been restored from is a hope, not a plan. Pick a mailbox and a folder a few times a year and make sure they actually come back.
Do you need it?
If losing a month of email or a folder of client files would cost you real money or trouble with a regulator, yes. That covers most businesses holding client records, and certainly any health practice. If everything important also lives in another system, such as job software or practice software with its own backups, the case is weaker, but check exactly what that system keeps.
Where we fit
Independent, tested backup of email, OneDrive and SharePoint is part of how we run every Microsoft 365 tenant we look after. So is the unglamorous work around it: leavers offboarded properly so their data is kept on purpose, admin accounts locked down, and restores tested on a schedule. If you're not sure what your business would get back after a bad day, ask us and we'll find out.
Sources
- Microsoft Learn: Shared responsibility in the cloud, Microsoft 365 Backup FAQ, Microsoft 365 Backup pricing
- Exchange Online: Recoverable Items folder, Default retention policy, Delete or restore mailboxes
- OneDrive and SharePoint: Restore deleted files, Restore your OneDrive, OneDrive retention and deletion, Unlicensed OneDrive accounts, Version history limits, Restore deleted sites
- Teams: Delete a channel, Restore a deleted group · Subscriptions: What if my subscription expires?
Checked 18 September 2026. If something here looks out of date, tell us.