--- title: "Microsoft 365 backup: what you lose after 14, 30 and 93 days" description: "Deleted email: 14 days. Deleted account: 30. Files: 93. What Microsoft 365 does not protect and what to demand from a managed backup. Get a proposal." language: en url: https://www.dataroad-it.com/en/managed-microsoft-365-backup-recovery-windows/ source: https://www.dataroad-it.com/en/managed-microsoft-365-backup-recovery-windows/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > Deleted email: 14 days. Deleted account: 30. Files: 93. What Microsoft 365 does not protect and what to demand from a managed backup. Get a proposal. # Microsoft 365 backup: what you lose after 14, 30 and 93 days At a glance For decision-makers short on time. - 01 Microsoft 365 does not include backup: Microsoft protects the platform, you protect the data. - 02 Default limits: 14 days for email, 30 for deleted accounts, 93 for files. - 03 Managed backup: a daily copy outside the tenant, immutable, with retention you set. - 04 Restores tested every quarter, with a written report. ### In this article When an employee leaves and their account is deleted, the company has 30 days to recover their email. After that, it is gone. **Microsoft 365 backup** is not included in the subscription: Microsoft keeps the platform running, but protecting the data is the company's job. This guide shows the real time limits, the costliest loss scenarios and how DataRoad manages an independent copy with tested restores. ## How long do you have to recover an email, an account or a file? Between 14 and 93 days, depending on the case. These are the defaults published by Microsoft and they apply to anyone without their own copy. | What was lost | Where it sits | Time limit | | --- | --- | --- | | Message deleted and removed from Deleted Items | Hidden Recoverable Items folder | 14 days (the administrator can raise it to 30) | | Deleted user account | Mailbox retained until permanent removal | 30 days | | Exchange licence removed | Grace period for mailbox data | 30 days | | Document deleted in OneDrive or SharePoint | Two-stage recycle bin | 93 days | | Entire OneDrive corrupted by malware | Restore your OneDrive option | Last 30 days only | Once the limit has passed, there is no button that brings the data back. ## Who is responsible for what: Microsoft or the company? Microsoft is responsible for the infrastructure; the company is responsible for the data. This is the shared responsibility model Microsoft itself publishes. - **Microsoft**: data centres, servers, availability and failures of its own hardware. - **The company**: email, documents, Teams and SharePoint; creating and removing accounts; passwords, MFA and permissions; laptops and phones that connect to the service. A failed disk in a data centre is Microsoft's problem. A lost folder is yours. The proof: Microsoft sells Microsoft 365 Backup separately, on a pay-as-you-go basis. ### Why are the recycle bin and sync misleading? Because neither is a copy. The recycle bin only holds removed files for a short time. Sync spreads mistakes and damaged files to every device in seconds. A true backup lives somewhere else, cannot be changed by accident and restores to whatever date you choose. ## Which scenarios cost a company most? ### The former employee with the client's proposal Someone leaves, the licence is released, the account is deleted. Months later, a client asks for a document that only existed in that mailbox or that OneDrive. The mailbox can only be recovered for 30 days; OneDrive has 30 days of retention by default, plus 93 days in the site collection recycle bin; recovering it requires admin commands. Without a copy, the loss is permanent within a few weeks. ### Ransomware that climbs into the cloud The infected laptop encrypts local documents. OneDrive does its job and replicates the encrypted versions to the cloud. You can roll back, but only up to 30 days and across the entire account, also wiping the good work done in the meantime. In a shared SharePoint library, the damage hits everyone who accesses it. ### The request that arrives too late A folder deleted in spring and searched for in autumn. An employee who deletes data on purpose and empties the recycle bin. An audit asking for the state of an archive on a date years ago. Only an independent copy can answer here. ## What should you demand from a Microsoft 365 backup? - **Full scope**: Exchange email, calendars and contacts, OneDrive, SharePoint and Teams, stored outside the company's tenant. - **Frequency**: at least one copy a day, with version history. - **Your retention**: one year or more, instead of Microsoft's 14, 30 or 93 days. - **Immutable copy**: impossible to delete during retention, even with a compromised administrator account. - **Leaver rule**: before removing an account, archive or convert the mailbox and confirm the copy exists. - **Mandatory MFA**: starting with administrators; read our guide to [MFA for businesses](https://www.dataroad-it.com/en/mfa-business-14-day-plan/). - **The right plan**: security features change with the licence; see [which Microsoft 365 licence protects an SME](https://www.dataroad-it.com/en/managed-microsoft-365-sme-licences-backup/). - **Proof of restore**: a quarterly test with a report, as described in [the 30-minute restore drill](https://www.dataroad-it.com/en/managed-backup-30-minute-restore-test/). ## How did we apply this in a real migration? In a public tender won by DataRoad, the [Union of Parishes of Massamá and Monte Abraão](https://www.dataroad-it.com/en/massama-monte-abraao-exchange-online-migration/) migrated a total of 50 mailboxes to Exchange Online. Messages, folders and associated data arrived intact. The work covered planning, the new Outlook configuration on computers and phones and final validation. Migration is the right moment to design the backup: the inventory of data, users and destination is already done. Skipping that step means accepting Microsoft's time limits. There are also clients whose email is not on Microsoft. [PTR Pharma Consulting](https://www.dataroad-it.com/en/ptr-pharma-consulting-managed-it-hosting/) has its website and email hosted on DataRoad servers, under an annual IT Unlimited contract. The requirement is the same: identify who owns the copy, where it is and the date of the last test. ## What does DataRoad's managed backup include? It includes an external copy, agreed retention, failure monitoring and rehearsed restores. Under an IT Unlimited contract it is active from day one, through our [managed backup solution](https://www.dataroad-it.com/en/managed-backup-services-portugal/), and works hand in hand with [Microsoft 365 administration](https://www.dataroad-it.com/en/microsoft-365-management/): licences, MFA and leaver processes. - **On-site support** On [IT Unlimited Premium](https://www.dataroad-it.com/en/it-unlimited-premium-on-site-support/), reinstalling a laptop or attending an on-premises recovery does not generate billed call-outs. - **Terms** One-year contract, renewed automatically, no lock-in. - **Track record** In 11 years, DataRoad has never suffered a security incident. ## Questions decision-makers ask us ### Does the Microsoft 365 subscription already include backup? No. It includes replication to keep the service running and a recycle bin of 14 to 93 days; a copy controlled by the company, with retention of its choosing, is contracted separately. ### Can retention policies serve as backup? No. They exist to meet legal and eDiscovery obligations, not to quickly restore a mailbox or a OneDrive to a given date, and the data stays in the same tenant. ### How do you protect a leaver's email? By converting the mailbox to a shared mailbox or confirming the backup before deleting the account. Without that, you have 30 days' margin. ### How long does a restore take? Minutes for a message or a file; hours for an entire mailbox or OneDrive, depending on volume. The restore test measures exactly this. ## Want to know what is unprotected today? In 5 working days we review your Microsoft 365, flag what sits outside any copy and deliver in writing the real recovery times and what to fix. Request a no-commitment proposal. **More than 10 workstations · support contract · remote, on-site and telephone support.** Call **+351 211 459 950 *** or write to sales@dataroad.pt. **Call to a Portuguese landline.* ## Microsoft documentation consulted - [Shared responsibility model (Microsoft Learn)](https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility) - [Deleted item retention in Exchange Online](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/change-deleted-item-retention) - [Delete and restore mailboxes](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/delete-or-restore-mailboxes) - [Retention and deletion in OneDrive](https://learn.microsoft.com/en-us/sharepoint/retention-and-deletion) - [Site collection recycle bin](https://support.microsoft.com/en-us/office/restore-items-from-the-site-collection-recycle-bin-5fa924ee-16d7-487b-9a0a-021b9062d14b) - [Restore your OneDrive](https://support.microsoft.com/en-us/office/restore-your-onedrive-fa231298-759d-41cf-bcd0-25ac53eb8a15) - [Microsoft 365 Backup pricing](https://learn.microsoft.com/en-us/microsoft-365/backup/backup-pricing) Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed cybersecurity ## One StepAhead of IT. The risk belongs to the board, the protection is ours. In 11 years, DataRoad has never suffered a security incident. - **5 ★** on Google · 52 reviews - **Top 5%** SMEs · scoring.pt - **0** DataRoad security incidents in 11 years We do **IT** right. DataRoad IT Unlimited ## Does your IT depend on a single person? Documentation, inventory and one contact who answers for everything. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/managed-microsoft-365-backup-recovery-windows/