It is the most reasonable wrong assumption in small business IT. The data lives in the cloud, Microsoft is an enormous company, so Microsoft must be backing it up.
Microsoft is not. At least not in the way people mean when they say it.
What Microsoft does is keep the service running, and keep enough redundant copies of your data that a failed server or a flooded datacenter never takes your email offline. That is real and it matters. What it does not do is protect you from your own people. Someone deletes the wrong folder. An attacker gets into an account. A bookkeeper leaves and empties their mailbox on the way out the door. In every one of those cases the options you have are the ones below, and each of them is already counting down.
None of this is secret. Microsoft publishes all of it. It is just scattered across a dozen documentation pages that nobody reads until the morning it matters.
What Microsoft actually says
The Microsoft Services Agreement, in the version published July 30, 2026, puts it plainly in Section 6.b: “In the event of an outage, you may not be able to retrieve Your Content or Data that you’ve stored. We recommend that you regularly backup Your Content and Data that you store on the Services.” Section 4.a.iv.2 adds that if an account closes, “You should have a regular backup plan as Microsoft won’t be able to retrieve Your Content or Data once your account is closed.”
That agreement governs consumer accounts. If you have a business subscription, your relationship is governed by the Microsoft Product Terms and the Data Protection Addendum instead, which carry the same underlying division. Microsoft’s own shared responsibility documentation states the principle directly: “For all cloud deployment types, you own your data and identities.” In the responsibility matrix on that page, for software as a service, which is what Microsoft 365 is, customer data, configurations and settings, and identities and users are all marked Customer. Not shared. Customer.
The clocks that are already running
These are the current values as of September 23, 2026. Some of them have changed over the years, so if you read an older article you may have picked up an outdated number.
Deleted email. An item deleted from the Deleted Items folder, or removed with Shift plus Delete, lands in the hidden Recoverable Items folder. The default retention there is 14 days. An administrator can raise it, but only to a maximum of 30 days. After that the item is removed from Exchange Online. Calendar items are an exception and are purged after 120 days.
A deleted mailbox. When you delete a user, Exchange Online keeps the mailbox in a soft-deleted state for 30 days, then it is permanently deleted and cannot be recovered. Simply removing someone’s license starts the same 30-day clock on their mailbox data.
Files in SharePoint and OneDrive. A deleted item sits in the site recycle bin for 93 days from the moment of deletion. If someone empties that bin, the item moves to the second-stage recycle bin for whatever is left of the 93 days. The clock does not reset when the item moves. Items deleted from the second-stage bin are purged immediately. A deleted SharePoint site is retained for 93 days. Microsoft keeps its own backups for 14 days beyond actual deletion, which support can use for a full site restore, and after that the data is gone.
A departed employee’s OneDrive. The default retention period is 30 days from the time the account is deleted from Microsoft Entra ID. The manager or a designated secondary owner gets an email and a seven-day warning, then the OneDrive is moved to the site collection recycle bin for 93 days, and recovering it from there requires PowerShell. Separately, any OneDrive without a valid license is automatically archived on its 93rd unlicensed day.
Closing the subscription. Under the standard Product Terms, Microsoft keeps your data in a limited function account for 90 days after expiration or termination so you can extract it, then deletes it.
Where the native tools stop
Microsoft gives you three things that look like backup and are not.
Retention policies preserve content. They do not restore it. When a user deletes an item covered by a policy, a copy goes to a hidden Preservation Hold library that Microsoft explicitly says “isn’t designed to be used interactively.” Getting content back out means running an eDiscovery search. That is a compliance workflow, not a recovery workflow, and it is not something your office manager is doing on a Tuesday afternoon.
Litigation hold stops the automatic purge and preserves the original copy of anything a user modifies. It is excellent at making sure evidence survives. It does nothing to roll a mailbox back to how it looked last Thursday, and it has quota limits of its own.
Version history is per file. Versioning retains a minimum of 500 major versions by default, which covers the “I overwrote the good spreadsheet” case nicely. But when versions are trimmed by a limit or an administrative job, Microsoft’s documentation states those deletions bypass the recycle bin entirely and cannot be recovered from it. And if the file itself is gone past 93 days, its version history went with it.
Now hold those three up against the things that actually cost businesses money.
Ransomware encrypts a mapped SharePoint library and writes new versions of thousands of files at once. Version history helps only if you can walk every single file back by hand, and only if you notice in time. A departing employee hard deletes a quarter of their mailbox and you have 14 days, assuming nobody changed the default. An administrator with full rights can delete a site collection, empty the second-stage bin, and switch off the policy that was supposed to catch all of it.
None of those are exotic. They are just Tuesday.
Microsoft does now sell a backup product
This is the part that changed, and it is worth knowing about before you buy anything else.
Microsoft 365 Backup is a real first-party Microsoft product. It protects SharePoint sites, OneDrive accounts, and Exchange Online mailboxes. Recovery windows are configurable at 3 months, 6 months, 1 year, or 2 years. Restore points run every 10 minutes for the prior two weeks, with weekly snapshots after that for SharePoint and OneDrive, and every 10 minutes for the prior 52 weeks for Exchange. Billing is pay as you go at $0.15 per GB per month for protected data, and restores are free. Setup requires linking an Azure subscription.
Two honest caveats. First, Microsoft describes the storage as append-only rather than fully immutable, because deletion is deliberately not blocked so customers can offboard, with a 90-day grace period to recover backups after offboarding. Second, the product protects those three workloads. Anything in your Microsoft 365 tenant that is not a SharePoint site, a OneDrive account, or an Exchange mailbox is not in scope.
What to do this week
You can do all of this yourself, and you should do it whether or not you ever hire anyone.
- Check your deleted item retention. If it is still at the 14-day default, raise it to 30. It is one setting and it costs nothing.
- Check your OneDrive retention for deleted users in the SharePoint admin center. The default is 30 days. If your offboarding process is slower than that, raise it.
- Make sure a manager or secondary owner is actually set for every account, so somebody gets the email before a departing employee’s files disappear.
- Write down your answer to one question: if every file and mailbox were encrypted tomorrow morning, what is the oldest point in time you could restore to, and who would do it? If you cannot answer that in a sentence, you do not have a backup strategy yet.
- Decide what your actual recovery window needs to be. A firm that has to reproduce seven years of records for an audit has a different answer than a five-person shop. The retention window drives the cost, not the number of employees.
If you want a second set of eyes on any of it, we are happy to look. We are an Arizona IT company that works with small and mid-size businesses across the East Valley, and we would rather you have this handled correctly than have it handled by us. Either way, please do not leave it to the 14-day default.