Most business owners assume that because their email, files, and calendars live in Microsoft 365, Microsoft is quietly backing all of it up somewhere. It’s an easy assumption to make — the service feels bulletproof, the interface never mentions backup, and nobody reads a cloud agreement before clicking "accept." That assumption is also wrong, and it’s one of the more common gaps we see when we onboard new managed IT clients in Boise and the Treasure Valley.
Microsoft 365 is built for uptime and availability, not for restoring what you deleted, what ransomware encrypted, or what a departing employee took with them. Understanding where Microsoft’s responsibility ends and yours begins is the difference between a five-minute recovery and a permanent loss.
What "Shared Responsibility" Actually Means in Microsoft 365
Cloud vendors operate under a shared responsibility model. Microsoft is responsible for the infrastructure: keeping servers running, patching the platform, and guaranteeing uptime under its service-level agreement. You are responsible for what happens to your data inside that platform — who can access it, how long you keep it, and whether you can get it back after someone deletes it, whether by accident or on purpose.
That split isn’t a hidden trick. Microsoft states it plainly in its own Microsoft Services Agreement, which every organization accepts when it signs up for a Microsoft 365 tenant.
What Microsoft’s Own Agreement Says About Your Data
The Services Agreement is direct about where liability stops. It warns that "in the event of an outage, you may not be able to retrieve your content or data that you’ve stored," and it recommends that customers "regularly back up your content and data that you store on the services." When an account is closed or a subscription lapses, Microsoft says it will delete the associated data and that it "won’t be able to retrieve your content or data once your account is closed."
The agreement also limits Microsoft’s liability to direct damages only, explicitly excluding consequential and lost-profit damages tied to data loss. In plain terms: Microsoft is not on the hook for what a lost customer database, a wiped project folder, or a deleted finance mailbox costs your business. That cost lands on you.
Where the Native Recycle Bin and Retention Features Fall Short
Microsoft 365 does include built-in retention tools — a recycle bin here, a retention policy there — but they’re compliance and housekeeping features, not backup. They have hard limits, and those limits are documented by Microsoft itself.
Exchange Online: a 30- to 44-day window, then it’s gone
When a user account is deleted, the mailbox is generally retained for 30 days before permanent removal. Within that window, deleted items also pass through Exchange’s Recoverable Items folder, where a timer job permanently purges expired content — by default within 14 days of the retention period ending, according to Microsoft’s own documentation on Exchange retention. Unless someone proactively places a retention policy, retention label, or litigation hold on a mailbox before the account is deleted, there’s no way to reach back further than that.
OneDrive and SharePoint: a 93-day countdown
Files deleted from OneDrive or SharePoint move through a first-stage and second-stage recycle bin. Combined, they give you 93 days — after that, the content is permanently deleted from both, per Microsoft’s retention documentation for SharePoint and OneDrive. The recycle bin also isn’t indexed, so it can’t be searched by legal or compliance tools, and it offers no point-in-time restore if you need to roll an entire library back to how it looked last Tuesday.
Neither of these systems was designed to survive ransomware that encrypts synced files, a misconfigured sharing link that exposes a folder, or an admin who deletes the wrong mailbox during offboarding. They’re recycle bins, not insurance policies.
How Data Actually Gets Lost
The scenarios that actually cause data loss in Microsoft 365 tenants are rarely dramatic system failures. They tend to be ordinary:
- An employee deletes the wrong folder and doesn’t notice for weeks
- An offboarded employee’s account is removed before anyone captures what was in it
- A phishing attack compromises credentials, and the attacker deletes or encrypts files to cover their tracks
- A retention policy is misconfigured, so content that should have been kept gets purged on schedule
- Ransomware syncs encrypted versions of files into OneDrive, overwriting clean copies
None of these require a Microsoft outage. All of them can outlast the native recovery windows built into Exchange, OneDrive, and SharePoint.
What a Real Microsoft 365 Backup Strategy Looks Like
Closing the gap doesn’t mean replacing Microsoft 365 — it means adding a layer Microsoft never promised to provide. A practical starting point looks like this:
1. **Third-party backup for Exchange Online, OneDrive, and SharePoint** — the three workloads that carry the most day-to-day business data and the most exposure
2. **Independent, immutable retention** that isn’t tied to the same admin account an attacker or a mistake could compromise
3. **Point-in-time restore** so you can recover a mailbox or a document library to its state before an incident, not just individual deleted files
4. **Regular restore testing**, since a backup you’ve never tried to restore from is a backup you don’t actually have
Frequently Asked Questions
**Does Microsoft back up Microsoft 365 data?**
No. Microsoft maintains platform uptime and infrastructure, but data backup and recovery are the customer’s responsibility under the shared responsibility model described in the Microsoft Services Agreement.
**How long does Microsoft keep deleted emails?**
Deleted mailboxes are generally retained for 30 days after account deletion, and items in the Recoverable Items folder are purged by default 14 days after their retention period ends, unless a retention policy says otherwise.
**How long do deleted OneDrive and SharePoint files stay recoverable?**
Up to 93 days total across the first- and second-stage recycle bins, after which the files are permanently deleted and unrecoverable through native tools.
**Is the OneDrive recycle bin a substitute for backup?**
No. It has a fixed retention window, isn’t searchable by eDiscovery tools, and offers no point-in-time restore for an entire mailbox or library.
The Bottom Line
Microsoft 365 is a reliable platform for running your business day to day, but "reliable" and "backed up" aren’t the same thing. Microsoft says so directly in its own service agreement. For Boise and Treasure Valley businesses that depend on email, shared drives, and Teams to operate, closing that gap with independent backup is one of the more affordable insurance policies available — and far cheaper than explaining to a client why their file is gone for good.
Sources
- Microsoft Services Agreement
- Learn about retention for Exchange | Microsoft Learn
- Learn about retention for SharePoint and OneDrive | Microsoft Learn
