Microsoft 365 is not backing up your files: what the 14, 30, and 93-day timers actually do

Microsoft 365 does not back up your company data by default. Microsoft replicates your mailboxes, OneDrive folders, and SharePoint sites across multiple data centres so the service stays online when a hard drive fails in Dublin or Amsterdam. If a file is deleted, overwritten by ransomware, or wiped when a staff member leaves, your data sits on a strict countdown timer of 14, 30, or 93 days before Microsoft purges it permanently.

When I run a security audit for a small business in London, I always ask where the company backups live. Four times out of five, the director points at the ceiling and says everything is in SharePoint and OneDrive now, so Microsoft handles it. That assumption is completely understandable, and it is the exact gap that turns a routine admin mistake into lost company records.

Replication is for Microsoft’s hardware, not your mistakes

There is a difference between availability and a backup, though cloud marketing works hard to blur the two. Availability means that if a power supply catches fire in a Microsoft rack at three in the morning, your staff can still open Outlook at nine. Microsoft is very good at availability.

The catch is that replication copies everything faithfully and immediately, including the bad things. If a laptop catches ransomware and the OneDrive sync client encrypts four thousand project files on the C: drive, Microsoft replicates those four thousand encrypted files to the cloud within seconds. If an angry leaver empties a shared client folder and clears the recycle bin on their way out, replication dutifully deletes those files across every data centre too.

I wrote recently about a database on my own server that had never been in a backup while every nightly job reported green. Microsoft 365 creates the cloud version of that comfort: everything looks safe because the logo at the top of the screen belongs to a trillion-dollar company, right up until you ask for a folder that disappeared in June.

The three countdown timers running on your tenant

Instead of a backup, standard Microsoft 365 business plans give you recycle bins and short rollback windows. Once a timer runs out, Microsoft support cannot bring the data back for you at any price.

Where the data lives	Default timer	Maximum limit	What happens when the clock runs out
Exchange Online deleted emails	14 days	30 days (if an admin changes it)	Purged from Recoverable Items and unrecoverable
Removed user mailbox (licence unticked)	30 days	30 days (unless converted to shared mailbox first)	Mailbox is hard-deleted along with the account
SharePoint & OneDrive recycle bins	93 days (across first and second stage)	93 days (or earlier if storage quota fills up)	Permanently deleted from both user and admin bins
OneDrive & SharePoint Files Restore	30 days	30 days	Cannot rewind ransomware or mass corruption past day 30

The departed employee trap

The most common way small businesses lose data in Microsoft 365 has nothing to do with hackers. Somebody leaves the company in March. In April, the person looking after the invoices notices you are still paying £10 or £18 a month for their Microsoft 365 licence, logs into the admin centre, and deletes the user or unticks the licence box to save the monthly fee.

Removing that licence starts a 30-day clock on their mailbox and their OneDrive. Thirty days later, the mailbox vanishes. Their OneDrive files drop into the site collection recycle bin for another 93 days and then vanish too. Nobody notices until November, when a client queries a contract variation agreed by email back in February and there is nothing left to search.

There is a clean way to offboard staff without paying for an idle seat: convert the leaver’s mailbox to a shared mailbox before removing the licence, and move their OneDrive files to a proper SharePoint library. Most small offices only discover that step after the first mailbox has already gone.

Why retention policies and Microsoft’s paid add-on only go halfway

People who know about the 93-day recycle bin usually point to Microsoft Purview retention policies, or to Microsoft’s own paid add-on (Microsoft 365 Backup, which costs about $0.15 per gigabyte a month).

Retention policies are built for legal compliance and eDiscovery, not operational recovery. If a folder hierarchy gets mangled or overwritten, pulling five thousand files out of a flat Preservation Hold library and putting them back into the right working folders with the right permissions is a miserable week of work.

And while Microsoft’s paid backup add-on is fast at rolling back a SharePoint site, it keeps the backup copies inside your same Microsoft 365 tenant. As I cover when testing server backups, a backup that lives inside the same account it exists to protect has a single point of failure. If an attacker compromises your Global Admin login, or if billing or compliance flags lock your Microsoft tenant, your live data and your backups are locked behind the same door.

What a proper Microsoft 365 backup actually needs

The NCSC’s current small-business guidance is blunt on this point: back up everything that matters, including Microsoft 365 email, OneDrive, SharePoint, and Teams, and keep a copy somewhere ransomware and a compromised admin account cannot reach.

When I set this up for a client, or check it during an infrastructure or security audit, I look for three things. First, the backup copies must leave Microsoft’s cloud and sit on separate storage with separate credentials. Second, the retention period should be at least a year (and longer for financial or project records), rather than Microsoft’s 30-day rollback ceiling. Third, somebody has to test restoring a mailbox and a SharePoint folder from it, because an untested backup is just a storage bill.

Common questions

Does Microsoft 365 Business Basic, Standard, or Premium include a full backup?
No. All three include high-availability replication and short-term recycle bins (14 days for permanently deleted mail, 30 days for point-in-time file rollback, and 93 days for deleted SharePoint and OneDrive files). None of them include an independent, long-term backup out of the box.

How do we keep an ex-employee’s emails without paying for their licence every month?
Before you remove their Microsoft 365 licence or delete their user account, convert their mailbox to a Shared Mailbox in the Exchange admin centre (free up to 50GB) and move their OneDrive files to a company SharePoint library. If you simply delete the user or remove the licence, Microsoft purges the mailbox after 30 days.

How much does an independent Microsoft 365 backup cost for a small team?
Typically between £2 and £4 per user per month, or a fixed monthly fee if you back up your tenant directly to your own off-site server or object storage. That covers Exchange, OneDrive, SharePoint, and Teams outside Microsoft’s walls.

If you are not sure what would happen to your SharePoint folders or old staff mailboxes if somebody deleted them tomorrow, have a look at my Security Audits or Servers and Infrastructure work, or send me a message and I will check your tenant settings with you.