Microsoft 365 backup: what native recovery will and won't restore

Most organizations that move to Microsoft 365 assume their mail and files are now backed up somewhere. They are partly right. Microsoft 365 keeps deleted content for a while, can be told to preserve content for much longer, and now sells a native backup product. Each of these does a different job, and the gaps between them are where a bad week turns into lost data.

This guide is for owners, operations leads and IT managers at small and mid-sized Canadian organizations. It explains what the built-in recovery features actually cover, why retention is not the same as backup, and the decisions to make before you need a restore rather than during one.

What Microsoft 365 recovers on its own

Every tenant gets a set of recovery windows without any extra configuration. They are useful, but they are short, and they are built for everyday deletions rather than a large-scale loss that goes unnoticed for weeks.

Exchange Online mailboxes

When a user empties Deleted Items or presses Shift+Delete, the message moves to a hidden Recoverable Items folder. Users can bring it back themselves with the Recover Deleted Items feature in Outlook. The default deleted item retention period is 14 days, and an administrator can raise it to a maximum of 30 days per mailbox.[1] Single item recovery and holds keep purged or modified items for longer, but those features exist mainly to support investigations and discovery, and finding content in them is a search exercise rather than a one-click restore.[1]

SharePoint and OneDrive

Files deleted through the browser go to the site Recycle Bin and are kept for 93 days from the original deletion. If someone empties that Recycle Bin, the items move to a second-stage Recycle Bin for the rest of the period; deleting them from there purges them immediately.[2] Deleted site collections are also kept for 93 days.[2]

Two details matter more than the headline number:

• Not every deletion reaches the Recycle Bin. Microsoft documents that an API call can either recycle an item or delete it outright, and a direct delete is purged immediately and cannot be recovered from either Recycle Bin.[2] Scripts, sync tools and third-party integrations use these APIs.
• The last resort is short. SharePoint keeps backups for 14 days beyond deletion so that Microsoft support can perform a full site collection or subsite point-in-time restore. After that, the data is gone.[2] A restore of this kind is also all-or-nothing for the site, not a way to pick out one folder.

The practical test. Ask how long it takes your organization to notice a problem. If a departed employee's folder was deleted, or a sync client quietly overwrote a shared library, would anyone raise it within two weeks? If the honest answer is no, the native windows are not your recovery plan.

Retention is not backup

Microsoft Purview retention policies and retention labels are often described as the answer to this problem. They solve a different one.

A retention policy makes sure content is kept (or deleted) for a set period. When a user edits or deletes content covered by a policy, a copy is automatically retained: in the Preservation Hold library for SharePoint and OneDrive, and in the Recoverable Items folder for Exchange mailboxes.[3] Retention labels can go further and mark content as a record, which restricts what people can do with it.[3] For organizations with record-keeping obligations there is also Preservation Lock, which stops anyone, including an administrator, from turning a policy off or making it less restrictive.[3]

That is valuable for compliance and investigations. It is weak as a recovery tool, for three reasons:

• It keeps items, not a working state. Retention preserves individual copies. It does not give you a site, library or mailbox as it looked at a point in time, with its folder structure and permissions intact.
• Recovery is a search and export. Retained Exchange content is found through Content Search or eDiscovery.[1] That works for a handful of messages. It is slow and error-prone for thousands of files after ransomware has encrypted a library.
• It is still inside the same tenant. Retention protects against users. It does not give you a copy held outside the admin roles that an attacker with a stolen global administrator account would control.

Use retention for what it is designed for: keeping records for as long as your policies and Canadian privacy legislation require, and deleting them when they should be deleted. Then plan backup as a separate control.

Microsoft 365 Backup: the native option

Microsoft now offers Microsoft 365 Backup, a separately billed service that backs up all or selected SharePoint sites, OneDrive accounts and Exchange mailboxes.[4] It addresses several of the weaknesses above:

• Point-in-time restore. A SharePoint site or OneDrive account can be rolled back to its exact state at an earlier point in time, and mailbox items can be restored in full or individually.[4]
• A longer recovery window. The window is set on the backup policy: three months, six months, one year or two years.[4]
• Protection from tampering. Microsoft states that backups use append-only storage, so earlier versions cannot be changed after they are saved.[4]

Read the restore behaviour carefully before relying on it. A full site or OneDrive restore rolls the location back and overwrites all content and metadata changed since that point in time.[4] Restoring to a new URL avoids overwriting legitimate recent work, and that choice needs to be in your runbook, not decided under pressure.

Also note the scope. The documented coverage is SharePoint, OneDrive and Exchange.[4] If your business depends on Teams chat history, Planner, Power Platform flows or your identity and security configuration, decide separately how each is protected or rebuilt. Microsoft also describes these backups as being created within the protected services' own data boundaries.[4] Whether that satisfies your requirement for a separate copy is a decision to make deliberately, not an assumption.

What good looks like for a small or mid-sized organization

The Canadian Centre for Cyber Security's guidance on backups applies to cloud services as much as to servers. It recommends the 3-2-1 approach (three copies, on two types of media, one kept offsite), an offline or otherwise disconnected copy where possible, and routine restore testing. It also reminds organizations that they remain legally responsible for protecting their data when a provider stores it, and that data residency should be part of the decision.[5]

Translated into Microsoft 365 terms, a sound design usually answers these questions in writing:

1. What must be recoverable? List the mailboxes, sites, libraries and Teams that the business cannot run without, and who owns each.
2. How far back? Match the recovery window to how long a problem could go unnoticed, not to the native defaults.
3. Where does the copy live? Native Microsoft 365 Backup, a third-party service with separate storage, or both. Decide whether a copy outside the tenant's admin boundary is required, and confirm where it is stored.
4. Who can delete backups? Backup administration should use separate accounts with multi-factor authentication, not the same global administrators who run the tenant day to day.[5]
5. How will you restore? Document when to restore in place and when to restore to a new location, and who approves a site-wide rollback.
6. When did you last prove it? Schedule a restore test of a real mailbox and a real library, and record how long it took.[5]

Where this fits

Backup decisions in Microsoft 365 sit between tenant administration and business continuity. Our Microsoft 365 security and administration service reviews retention, recovery settings and administrator access in the tenant itself. Our resilience and recovery work designs and tests the restore path, and the managed IT services page explains how ongoing checks such as scheduled restore tests are handled.

If you are not sure what your organization could recover from Microsoft 365 today, or how far back, contact HAI Consulting for a free initial consultation. We will review what is actually protected, where the gaps are and what it would take to close them.