Partly. Microsoft keeps the service running and keeps deleted items for a limited time. It does not keep a separate, long-term copy of your data that you can restore from on your own terms.
The space between those two things is where most Microsoft 365 data problems sit. This article sets out what Microsoft protects, where that protection ends, and what to check in your own tenant.
What Microsoft does protect
Microsoft runs the infrastructure. It stores your data redundantly across its data centers, so a failed disk or server on its side does not cost you mail or files. That is availability, and Microsoft does it well.
On top of that, each part of Microsoft 365 has its own safety nets for deleted items:
- Exchange mail keeps deleted messages in a recoverable items area for a limited period, which your admin can adjust within Microsoft’s limits.
- SharePoint and OneDrive have recycle bins. Microsoft’s support documentation says that in SharePoint, “items are retained for 93 days from the time you delete them from their original location.” (Microsoft Support)
- Version history in SharePoint and OneDrive lets you open earlier versions of a document.
- Retention policies and holds, available with some licenses, can keep content for compliance and legal reasons.
These are useful, and they handle many everyday mistakes. If someone deletes a file this morning and asks for it this afternoon, the recycle bin is the fastest answer.
Where that protection ends
The safety nets share three limits.
They expire. The 93-day window for SharePoint is generous for an accidental deletion noticed this week. It does not help with a folder deleted in January and missed until May. After the window, the item is gone.
They live inside your tenant. Anyone with enough admin rights can empty recycle bins or change retention settings. So can someone using a stolen admin password. A fallback that the same person can delete is not much of a fallback.
They are not built for restores. Retention policies keep content so it can be searched and exported for legal and compliance work. Putting a whole mailbox or site back the way it looked on a given date is not what they are for.
There is a fourth, quieter gap: departed staff. When someone leaves and their license is removed, their mailbox and OneDrive are deleted after a while. Unless someone moved or kept that data first, it goes too.
What Microsoft itself recommends
The Microsoft Services Agreement, in section 6.b, says: “We recommend that you regularly backup Your Content and Data that you store on the Services.”
To be fair about it, that agreement covers Microsoft’s consumer services, and business tenants sign different terms. But the advice holds for any cloud service. The provider keeps the platform running. Keeping your own copy of what is on it is your side of the arrangement. Engineers call this the shared responsibility model.
How data actually goes missing
Four common situations fall outside Microsoft’s own safety nets:
- A deletion found late. Someone tidies a SharePoint library or a OneDrive folder, and the gap is noticed after the recycle bin window has closed.
- A departed employee. The account is removed to free the license, and months later a client asks for an email thread that only that person had.
- A bad change that syncs. A laptop syncs mass deletions or ransomware-encrypted files into OneDrive. Version history and OneDrive’s own restore feature can undo much of it if the problem is caught early, but not if it is found late or spread across many sites.
- A compromised admin account. Someone with admin access deletes users, sites or retention settings, and the safety nets go with them.
In each case the data is gone from Microsoft 365 itself, so a copy held outside it is the only way back.
Where Teams keeps things
Teams is an easy one to miss, because it stores its parts in different places. Files shared in a channel live in that team’s SharePoint site. Files shared in a private chat live in the sender’s OneDrive. The chat messages themselves are held by Microsoft separately from both.
So when someone asks whether Teams is backed up, the honest answer depends on which part of Teams they mean. It also means a departed user’s OneDrive holds every file they ever shared in a chat, which is one more reason to keep departed accounts in the backup.
What a separate backup adds
A separate backup of Microsoft 365 copies mail, files, sites and chats out of your tenant into separate storage, on a schedule, and keeps versions for as long as you choose. Restores can go to the original place or somewhere new, one item or a whole mailbox at a time.
What to look for:
- Coverage: Exchange mail, OneDrive, SharePoint, and Teams chats and files, not only mail.
- Frequency: several copies a day, so a morning’s work is covered.
- Retention: a year at least, with the option to go longer for records you must keep. Your counsel or compliance officer decides how long that is.
- Separate credentials: a copy that your Microsoft 365 admin account cannot delete.
- Departed users: kept after the license is removed, without paying for a seat.
- Tested restores: someone restores an item and a mailbox on a schedule, and writes down the result.
The Microsoft 365 Backup plan covers Exchange mail, OneDrive, SharePoint, and Teams chats and files. It copies them 3 times a day, keeps a year of versions by default (extendable to 7 years), restores single items or whole mailboxes, and keeps departed staff accounts at no extra cost while the backup is kept. It starts from $4 per user per month (indicative).
The Microsoft 365 and Google Workspace backup service page explains how it fits alongside the Google Workspace plan, for offices that run both.
Example: a departed recruiter’s mailbox
Picture an 18-person staffing agency. A recruiter leaves in March. To save the license fee, the office manager removes the account in April. In September, a client disputes a placement fee and asks for the email thread where the terms were agreed. Only the recruiter had it.
Without a separate backup, the mailbox was deleted months ago. The thread is gone unless someone else happened to be copied on it.
With a backup that keeps departed users, the request is ordinary. Find the recruiter’s mailbox in the backup, search for the client’s name, and restore the thread into the office manager’s mailbox as a separate folder. Our target for a single mailbox item is 1 business hour from the request.
The agency did nothing unusual. Removing a departed user’s license is sensible housekeeping. It only became a problem because nobody kept a copy first.
Check your own tenant
A short session in your Microsoft 365 admin center answers most of this:
- How long does deleted mail stay recoverable in your tenant today?
- Who has global admin rights, and does every one of them use two-factor sign-in?
- What happens, step by step, to a departed user’s mailbox and OneDrive?
- Do you have any retention policies, and does anyone know what they keep?
- Is there any copy of your mail and files outside the tenant?
- When did anyone last restore a deleted item older than a month?
If the answer to question 5 is no, that is the one to fix first. The small business backup guide covers cloud apps alongside servers and laptops, if you want the wider picture.
What this does not replace
A backup does not replace Microsoft’s own tools. The recycle bin is still the quickest way back for this morning’s mistake, and retention policies still have a job for compliance. Keep both. The backup is for everything that falls outside their windows, or that someone with admin rights could remove.
Nor does it replace good admin habits: two-factor sign-in on every account, few global admins, and a written process for when someone leaves.
A second look at your tenant
If you would like someone to look at this with you, the free backup check covers Microsoft 365. In 45 minutes, remotely, we review what is protected today, run one test restore and send a written page of findings. Book a free backup check when it suits you.
