Has an insurer, a new IT provider, or a colleague asked whether your Microsoft 365 data is backed up? Since you pay Microsoft every month, it’s an easy question to answer with a quick “yes.” Microsoft 365 backup is separate from the subscription, though, and Microsoft’s documentation spells out the difference in days. It helps to know those numbers before anyone asks again.
Does Microsoft 365 Back Up Your Data?
Microsoft keeps the service running and holds deleted items briefly, but restoring your data after a loss falls to you. The distinction comes down to availability versus backup. Availability means Microsoft 365 is up when you sign in. A backup is a separate copy of your files and email. You can restore it after an accidental deletion, an overwrite, or a cancellation.
A shared folder deleted by mistake and a spreadsheet saved over last month both need an earlier copy. Microsoft’s holding period can resemble that copy at first glance, though the two diverge once it ends. That raises the question of who owns which part, and Microsoft answers it in its own guidance.
What Does Microsoft Protect, and What Stays With You?
Microsoft’s shared responsibility guidance assigns platform maintenance to Microsoft, while your data, configuration, and identities rest on your shoulders. Configuration covers your settings and permissions, and identities are the sign-ins your team uses. Since this is general guidance for all cloud customers, your own agreement is where to confirm specifics.
Microsoft Keeps the Platform Running
Microsoft’s side is the service itself. It keeps Microsoft 365 available, so email, files, and Teams meetings load when your team signs in. That reliability is what the monthly fee buys, and it’s considerable.
You Keep Responsibility for the Data
Your side covers everything stored inside the platform. Each mailbox, file, and setting belongs to you, and so does restoring them after a deletion. Guarding that data against loss is a topic of its own, covered in our guide to data loss prevention.
Microsoft does provide some help with deleted items, so the natural next question is how long it lasts.
How Long Does Microsoft 365 Keep Deleted Files and Email?
Microsoft keeps deleted email for 14 days by default (30 at most) and deleted files for 93 days. Files pass through two recycle bins on the way out, and the 93 days cover both stages together. Email follows its own path through the Recoverable Items folder, a hidden holding area in Exchange Online for messages a user has deleted. Those periods are enough to fix accidental deletions, like a message removed in error or a folder cleared last week. Once a period closes, the item can’t be restored from the recycle bin. The table below shows how they compare.
Microsoft 365 recovery windows at a glance
| What you need back | How long it’s available |
|---|---|
| Deleted email | 14 days by default, up to 30 days |
| Deleted files, across both recycle bins | 93 days total |
| Data after a subscription ends | 90 days in a limited-function account, then deleted within 180 days at most |
| Data covered by the Microsoft 365 Backup add-on (sold separately) | 3 months to 2 years |
Microsoft sells the Backup add-on in the last row, so it has a commercial interest in whether you buy it. Every row ends on a fixed date, and that’s where the gap begins.
Why Aren’t Recovery Windows the Same as a Backup?
A recovery window counts down on deleted items, while a backup is a separate copy that outlasts the countdown. A cancelled subscription shows the gap best. Microsoft holds the data in a limited-function account for 90 days, and everything is deleted within 180 days at most. If a business cancels and needs an old contract eight months later, Microsoft has nothing left to restore.
Deleted email gets less time, at 30 days at most, which is brief for a tool teams use daily. A folder deleted in June can be out of the recycle bin for good by October, and the first person to notice may be whoever needs it for an audit or a contract.
Recovery window: an undo button for recent deletions.
Backup: a separate copy you can restore from long after the undo button expires.
Two quick questions can help you check your own exposure. When did your team last open a file older than three months, and would anyone have noticed its absence? Because 93 days is roughly three months, that’s about the point where Microsoft’s file window closes for good.
What Closes the Gap Between Microsoft’s Coverage and Yours?
Microsoft’s paid add-on, a separate backup service, and sharper questions for your IT provider each close part of the gap. The Cybersecurity and Infrastructure Security Agency (CISA), a U.S. government agency, advises businesses to understand the shared responsibility model. It also recommends backing up often, offline or cloud-to-cloud, meaning a copy kept with a different cloud vendor than the original.
Microsoft’s Paid Backup Add-On
Microsoft sells its own option, Microsoft 365 Backup, as a pay-as-you-go add-on. Recovery windows run from 3 months to 2 years. Billing follows the amount of data stored rather than the number of users, so the monthly cost rises and falls with the size of your files and mailboxes. Microsoft Purview retention policies, the rules that keep data for compliance reasons, don’t change this backup window. Current pricing and limits are listed in Microsoft’s documentation.
Third-Party Backup Services
Separate backup services copy Microsoft 365 data to a location outside your Microsoft account on a set schedule. That keeps a copy available after Microsoft’s periods end. Options differ in how often they copy, how long they keep older versions, and how quickly they restore. Those details matter more than the brand name, because they decide how much of a bad day you can undo and how quickly your team gets back to work.
Questions to Ask Before You Choose
These questions work for Microsoft, a backup service, or your current IT provider:
- How far back can I restore, and who sets that limit?
- How often is my data copied, and where does the copy live?
- Does the backup cover email, files, and shared sites, or only some of them?
- Who can restore a file, and how long does a restore usually take?
- Can I see a test restore before I rely on it?
If you only ask one, make it how many days back can you restore my email and files? CISA’s guide also advises making sure a managed provider follows the same backup best practices and writing those requirements into the contract. Backup is one piece of a larger plan, and our guide to small business disaster recovery covers the rest.
Where to Go From Here
Microsoft keeps Microsoft 365 running and holds deleted email for 14 to 30 days and deleted files for 93. Beyond those periods, recovery depends on a separate copy of your data. If you’re unsure how much recovery time you have today, it’s worth checking with someone who can review your setup. You can reach out to our team about your situation, and we’ll help you sort out your Microsoft 365 backup.
