In summary
- Microsoft guarantees that Microsoft 365 works. The data, the accounts, and anyone who touches them are the responsibility of your company — that’s what Microsoft itself calls shared responsibility.
- A permanently deleted email can be recovered after 14 days of inaction (maximum 30). The mailbox of a deleted user is 30 days. Files deleted in OneDrive and SharePoint are 93 days.
- After these deadlines, without an independent backup, the information disappears — and a ransomware attack can synchronize encrypted files to the cloud.
- The solution: daily backups outside of Microsoft 365, retention defined by you, and a restore test at least once per quarter.
In this article
- What Microsoft guarantees — and what remains on the side of its company
- Deadlines that almost no one knows about
- Checklist: what should exist in a company with Microsoft 365
- A real case: 50 mailboxes migrated to Microsoft 365
- How we handled this in an IT Unlimited contract
- Frequently Asked Questions
- Microsoft 365 backup verification in 5 working days
The Microsoft 365 backup It’s the piece that’s missing in most companies that have moved email and files to Microsoft’s cloud. “It’s in the cloud, so it’s safe” is half true: Microsoft protects the platform against damage, but it doesn’t store what its users delete, change, or encrypt indefinitely. If someone deletes the wrong folder, if the account of the person who deleted it is deleted, or if ransomware enters through a laptop, recovery depends on short deadlines and tools designed for minor accidents—not for disasters.
What Microsoft guarantees — and what remains on the side of its company
Microsoft publishes a shared responsibility model for its cloud services. The most important sentence is this: whatever the type of service, the customer always retains responsibility for it. data, by equipment who access the service through accounts from the user and by access management.
| Area | Microsoft | Your company |
|---|---|---|
| Data centers, servers and service availability | Yes | — |
| Microsoft hardware failure protection | Yes | — |
| Data (emails, files, Teams, SharePoint) | — | Yes |
| User accounts: create, maintain, delete | — | Yes |
| Accesses: passwords, MFA, permissions | — | Yes |
| Portable devices and mobile phones that access the service | — | Yes |
If Microsoft loses a disk, the problem is theirs. If your company loses a file, the problem is yours. Not by chance, Microsoft itself sells a separate backup service, Microsoft 365 Backup, charged on a consumption basis.
Deadlines that almost no one knows about
The deadlines below come from the official Microsoft documentation, in the default configuration. These are the ones that apply today, unless you have an independent backup.
| Situation | What happens | Time to recover |
|---|---|---|
| Email deleted and then removed from the “Deleted Items” folder” | It goes to a hidden folder of recoverable items | 14 days for omission; the administrator can extend it up to 30 |
| User removed from Microsoft 365 | The mailbox remains retained and then is permanently deleted | 30 days |
| Exchange license withdrawn from a user | The email data is available for free for a period of time. | 30 days |
| File deleted in OneDrive or SharePoint | It is in recycling (first and second phase) | 93 days |
| Entire OneDrive is corrupted (for example, malware) | It is possible to undo with the “Restore OneDrive” | Last 30 days |
When an employee leaves
This is the most common scenario. Someone leaves, the account is deleted to release the license, and months later a customer requests a proposal that only existed in that person’s email or OneDrive. According to Microsoft, the mailbox of a deleted user can only be recovered for 30 days; after that it is deleted and cannot be recovered. In OneDrive, the retention period for omission is also 30 days, which is added to the 93 days for recycling the site collection — and recovery requires administrative commands.
Without backup, the “delete account” decision is irreversible after a few weeks.
When ransomware syncs
An infected laptop encrypts local files. OneDrive, true to its function, sends those encrypted versions to the cloud. Microsoft allows you to restore a OneDrive to a previous moment, but only within the last 30 days, and it restores the entire account — legitimate work done after that point is lost. In SharePoint shared folders, the impact multiplies for all the users who access them.
There are still situations that no recycling solution can solve: the folder deleted in March and sought in September, the employee who deletes data intentionally and empties the recycling, or the audit that requests what existed on a specific date, years later. In all of them, the question is the same: where does the copy come from?
Checklist: what should exist in a company with Microsoft 365
- Independent backup of Exchange (email, calendars, contacts), OneDrive, SharePoint and Teams, stored outside the company's Microsoft 365 account.
- Daily frequency, At least with several versions per file.
- Retention defined by the company (for example, 1 year or more), instead of 14, 30 or 93 days.
- A copy that cannot be deleted during the retention period, not even by a committed administrator.
- Procedure for the departure of employees: convert or archive the mailbox and confirm that the backup exists before deleting the account.
- MFA on all accounts, Especially in management positions — see our guide on multi-factor authentication.
- The right licenses: the security varies per plan — see Microsoft 365 for SMEs: licenses and security.
- Replacement test at least quarterly, with a written report — the method is in the 30-minute test that the supplier must ask for.
A real case: 50 mailboxes migrated to Microsoft 365
Na Migration of the Union of the Freguesias of Massamá and Monte Abraão, 50 mailboxes were transferred to Exchange Online by DataRoad through a public tender, with all the content—emails, folder structure, and associated data. The work included planning the migration path, reconfiguring Outlook on workstations and mobile devices, and validating after the transition.
A migration is the ideal time to address backup: it is known that data exists, who uses it and where it resides. Those who migrate without drawing up a backup plan become dependent on the deadlines outlined above.
Not all companies have the email in Microsoft 365. A PTR Pharma Consulting, For example, it hosts the website and email on the DataRoad servers, under the annual IT Unlimited contract. The question, however, is always the same: who keeps the copy, where, and when it was last tested.
How we handled this in an IT Unlimited contract
At DataRoad, the backup of Microsoft 365 is included in the contract from day one. We configured it backup solution with a copy outside of Microsoft 365, we define retention with the administration, we monitor the failure alerts, and we perform replacement testing with logging. We combine the Microsoft 365 management — licenses, MFA, employee departures.
At the top level IT Unlimited Premium, On-site assistance is included: if a laptop needs to be replaced or a recovery session needs to be conducted in the office, there are no separate fees for travel. The contract is annual, with automatic renewal, 60 days’ notice, and no commitment to stay with the provider.
Frequently Asked Questions
Does Microsoft 365 back up my data?
Not in the sense of a copy that the company controls. Microsoft replicates the data to ensure that the service does not fail, and offers recycling and retention for short periods (14 to 93 days, depending on the case). An independent backup with a retention set by you must be contracted separately.
Do the retention policies of Microsoft 365 replace backup?
No. Retention policies are primarily for compliance and legal research purposes. They were not designed to quickly restore a folder, mailbox, or entire OneDrive at the date of your choice, and the data remains within the same Microsoft 365 account.
What happens to an employee's email when they leave the company?
If the account is deleted, the mailbox can be recovered within 30 days; after that, it is permanently deleted. Before deleting the account, it is advisable to convert the mailbox to shared or confirm that there is a backup.
How long does it take to restore data from a backup?
An email or file is restored in minutes. A mailbox or a full OneDrive can take hours, depending on the volume. That's what a restore test measures.
Microsoft 365 backup verification in 5 working days
We analyze your company's Microsoft 365 account, identify what is and what is not protected, and deliver a report with actual recovery timelines and the fixes to be made. For companies with more than 10 seats · contract of assistance · remote, on-site, and telephone support.
Microsoft 365 backup verification
Report within 5 working days, with what is and is not protected
Sources
- Microsoft Learn — Shared responsibility in the cloud
- Microsoft Learn — Change how long permanently deleted items are kept (Exchange Online)
- Microsoft Learn — Delete or restore user mailboxes in Exchange Online
- Microsoft Learn — OneDrive retention and deletion
- Microsoft Support — Restore items from the site collection recycle bin
- Microsoft Support — Restore your OneDrive
- Microsoft Learn — Pricing model for Microsoft 365 Backup
![mun[it] logo, a digital marketing agency — a DataRoad client](https://www.dataroad.pt/wp-content/uploads/2026/09/logo-cliente-munit.png){kind=logo}
