In this article
Microsoft 365 is not a backup. Microsoft ensures the service is available, but the data, accounts and access are the company's responsibility. By default, a permanently deleted email can be recovered for 14 days (up to 30 if the administrator extends it), a deleted user's mailbox for 30 days and a OneDrive or SharePoint file for 93 days. After that, without an independent copy, the information is lost.
Shared responsibility: the company's share
Microsoft publishes a shared responsibility model for its cloud services. In every type of service, the customer always remains responsible for the data, the devices that access the service, user accounts and access management.
| What is at stake | Responsible |
|---|---|
| Data centres, servers and service availability | Microsoft |
| Failures of Microsoft's own hardware | Microsoft |
| Emails, files, Teams and SharePoint | Company |
| Creating, maintaining and deleting accounts | Company |
| Passwords, MFA and permissions | Company |
| Laptops and phones with access to the service | Company |
If Microsoft loses a disk, that is Microsoft's problem. If the company loses a file, that is the company's problem. It is no coincidence that Microsoft itself sells Microsoft 365 Backup separately, charged by consumption.
Recycle bins and synchronisation are not backups
The recycle bin keeps what was deleted for a few days. Synchronisation replicates everything, including mistakes and corrupted files, to every device at the same time. A backup is a separate copy, stored elsewhere, that nobody alters by accident and that can be restored to a chosen date.
Default recovery windows
Figures from Microsoft's official documentation, in the default configuration. These are what apply today to anyone without an independent backup.
| Scenario | Behaviour | Recovery window |
|---|---|---|
| Email deleted and removed from “Deleted Items” | Moves to a hidden recoverable items folder | 14 days; up to 30 if the administrator extends it |
| User deleted | The mailbox is retained and then permanently deleted | 30 days |
| Exchange licence removed | Email data enters a grace period | 30 days |
| File deleted in OneDrive or SharePoint | First- and second-stage recycle bin | 93 days |
| Entire OneDrive damaged, for example by malware | “Restore your OneDrive” feature | Last 30 days |
Three situations where the recycle bin is not enough
The account of someone who has left
This is the most frequent case. An employee leaves, the account is deleted to release the licence and, months later, a client asks for a proposal that only existed in that person's email or OneDrive. The mailbox is only recoverable for 30 days. In OneDrive, default retention is also 30 days, plus 93 in the site collection recycle bin, and recovery requires admin commands. Without a backup, deleting the account becomes irreversible within a few weeks.
Ransomware synchronised to the cloud
An infected laptop encrypts local files and OneDrive faithfully sends those versions to the cloud. OneDrive can be restored to an earlier point, but only within the last 30 days and for the entire account: legitimate work done afterwards is lost. In shared SharePoint folders, the impact is multiplied across all users.
Requests outside the window
The folder deleted in March and looked for in September, the employee who deletes data on purpose and empties the recycle bin, the audit that asks for the state of a folder on a specific date, years later. The question is always the same: where does the copy come from?
Backup checklist for companies using Microsoft 365
- Independent copy — Exchange (email, calendars, contacts), OneDrive, SharePoint and Teams, stored outside the company's Microsoft 365 tenant.
- Frequency — at least daily, with several versions per file.
- Retention set by the company — for example one year or more, instead of 14, 30 or 93 days.
- Immutability — a copy that cannot be deleted during the retention period, not even by a compromised administrator.
- Staff departures — convert or archive the mailbox and confirm the backup before deleting the account.
- MFA on every account, starting with administrator accounts. See the guide to multi-factor authentication in companies.
- Appropriate licensing — the security available changes from plan to plan; read Microsoft 365 licences and security for SMEs.
- Quarterly restore test with a written report, following the 30-minute test to ask your provider for.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
In practice: migrating 50 mailboxes
DataRoad won a public tender for the Microsoft 365 migration of the União das Freguesias de Massamá e Monte Abraão. 50 mailboxes were transferred to Exchange Online with all their content: emails, folder structure and associated data. The project included planning the route, reconfiguring Outlook on workstations and phones, and validation after the switchover.
A migration is the best moment to design the backup, because you know what data exists, who uses it and where it is going. Anyone who migrates without doing so is left relying on the windows in the table.
Not every company uses Microsoft 365 for email. PTR Pharma Consulting has its website and email hosted on DataRoad servers, under the annual IT Unlimited contract. The question remains the same: who keeps the copy, where, and when was it last tested.
Microsoft 365 backup as a managed service
Under an IT Unlimited contract, Microsoft 365 backup is included from day one. DataRoad configures the managed backup solution with a copy outside Microsoft 365, agrees retention with management, follows up failure alerts and carries out recorded restore tests. On top of this comes Microsoft 365 management: licences, MFA and staff departures.
On the IT Unlimited Premium plan, on-site support is included: restoring a laptop or overseeing a recovery at the office generates no invoiced call-outs. Annual contract, automatic renewal, 60 days' notice and no lock-in. In 11 years, DataRoad has never suffered a security incident.
Frequently asked questions
Does Microsoft 365 back up the company's data?
Not in the sense of a copy the company controls. Microsoft replicates data to keep the service running and offers recycle bins and retention for short periods, between 14 and 93 days. An independent backup, with retention chosen by the company, is contracted separately.
Do retention policies replace backup?
No. They mainly serve compliance and legal discovery, not quickly restoring a folder, a mailbox or an entire OneDrive to a given date. And the data stays inside the same Microsoft 365 tenant.
What happens to the email of someone who leaves the company?
Once the account is deleted, the mailbox can be recovered for 30 days and then disappears. Before deleting, convert it to a shared mailbox or confirm there is a backup.
How long does a restore from backup take?
An email or a file, minutes. A full mailbox or OneDrive, hours, depending on the volume. That is precisely what the restore test measures.
Next step: Microsoft 365 backup check within 5 working days
We review the company's Microsoft 365 tenant, identify what is and is not protected, and deliver a report with real recovery times and the fixes needed. No-obligation request to sales@dataroad.pt.
More than 10 workstations · support contract · remote, on-site and telephone support.
Sources
- Microsoft Learn — Shared responsibility in the cloud
- Microsoft Learn — Change how long permanently deleted items are kept (Exchange Online)
- Microsoft Learn — Delete or restore user mailboxes in Exchange Online
- Microsoft Learn — OneDrive retention and deletion
- Microsoft Support — Restore items from the site collection recycle bin
- Microsoft Support — Restore your OneDrive
- Microsoft Learn — Pricing model for Microsoft 365 Backup
