Microsoft 365 Backup: Why Retention Is Not the Same as Recovery

Microsoft 365 Backup: Why Retention Is Not the Same as Recovery

Originally published 19 October 2020 · Reviewed 5 November 2026

Many organisations assume that because Microsoft hosts their email and files, Microsoft also backs them up in the sense that matters to a business: being able to get back what was lost, exactly as it was, whenever it is needed. That assumption is often wrong. This article explains the difference between availability, retention and backup, where the built-in protections stop, and how to decide what you need. It is not a product review, and details of Microsoft's features change, so check the linked documentation.

Availability, retention and backup are different things

• Availability means the service stays up. Microsoft invests heavily in redundant datacentres so that if hardware fails, you still reach your mailbox.
• Retention means data is kept for a period, for compliance or as a safety net, through features such as recycle bins and retention policies.
• Backup means an independent, point-in-time copy that you can restore from, even if the original and its in-service safety nets are damaged.

Microsoft provides the first, a good amount of the second, and, until recently, little of the third as part of the standard licence. Microsoft's services agreement describes a shared responsibility: Microsoft runs the service, and you are responsible for your content and for choosing how to protect it. The agreement recommends that customers regularly back up their content.

What the built-in safety nets cover

• Exchange Online keeps deleted items in a Recoverable Items folder for a default of 14 days, which an administrator can extend to 30.
• SharePoint and OneDrive use recycle bins, with items kept for 93 days in total across the first-stage and second-stage bins.
• Versioning in SharePoint and OneDrive lets you roll back a file to an earlier version, within the number of versions you keep.
• Retention policies and holds in Microsoft Purview can preserve content for a defined period, which is useful for compliance.

These cover everyday mistakes well. They are not designed to be a full restore system.

Where the gaps are

1. Time. A deletion or corruption noticed after the retention window is gone. Slow-burning problems, such as an automation that overwrites files over weeks, may not be noticed in time.
2. Malicious or compromised administrators. An attacker who gains administrative rights can delete content and sometimes the safety nets too. Permanent deletion may bypass recycle bins.
3. Ransomware and mass changes. Syncing clients can propagate encrypted or deleted files. Versioning may help, but it has limits and the restore process can be slow for large volumes.
4. Restore granularity. Restoring an entire user, site or mailbox to a point in time, or restoring a deleted list or site structure, is difficult with only recycle bins.
5. Retention is not recovery. A retention policy keeps data for compliance purposes, but it does not provide a convenient restore of an earlier state, and it can increase storage use.
6. Departed users. When an account is deleted, its mailbox and OneDrive content follow set retention rules; that may not match what the business needs.
7. Compliance and e-discovery. Some regulations and customer contracts require independent copies or specific restoration times.

Options

• Rely on built-in protection and accept the limits. This can be reasonable for a small team with low-risk data, if you understand the windows.
• Microsoft 365 Backup, a Microsoft service for restoring SharePoint, OneDrive and Exchange data to a point in time. Check availability, scope, price and limits.
• Third-party backup services, which copy data to independent storage and offer granular restores. Evaluate security, data location, encryption, access model and exit options.
• Procedural controls, such as restricted administrator roles, Privileged Identity Management, alerts for mass deletion and tested exports, which reduce the chance of needing a restore.

How to decide

1. List what you must recover: mailboxes, files, Teams data, Planner, Power Platform, and so on.
2. Set targets: how far back do you need to restore, and how fast?
3. Check legal and customer requirements for retention and independence.
4. Assess the threats, including ransomware, insider risk and compromised admin accounts.
5. Test a restore of a single mailbox and a folder of files before you rely on any option.
6. Review costs per user per month against the cost of an outage.
7. Document the decision and revisit it yearly.

What not to do

Do not assume that a retention policy replaces a backup, do not give the backup tool more access than it needs, and do not keep the backup credentials in the same tenant without strong protection. Treat the backup service as a high-value target and secure it with MFA and separate administration.

A simple test

Pick one person, delete a few important files and a folder of email, and ask your administrator to get them back as they were three weeks ago. If the answer is quick and complete, your current protection suits that scenario. If it is slow, partial or impossible, you have found the gap in a safe way, before a real incident. Repeat the test for a SharePoint site with a changed structure. Write down how long each restore took and who could do it, because that is the evidence you will need if a customer or auditor asks how you would recover from a serious data-loss event.

Microsoft references

• Microsoft Services Agreement, reviewed 5 November 2026.
• Recoverable Items folder in Exchange Online, reviewed 5 November 2026.
• Restore items in the recycle bin of a SharePoint site, reviewed 5 November 2026.

This article was first published on 19 October 2020. It was rewritten on 5 November 2026 as a vendor-neutral explanation with current product names. Microsoft's live documentation takes precedence if it has changed.