Does Microsoft 365 Back Up Your Data? The Retention Windows Most Businesses Miss

"It's in the cloud, so it's backed up." We hear it from almost every business we meet, and it is half true.

Microsoft and Google run very resilient services. They keep their data centers running when hardware fails. That is a different job from protecting you against your own deletions, a departed employee's account, or ransomware quietly syncing encrypted files into OneDrive. For those, the built-in safety nets exist, but every one of them has an expiry date.

The retention windows, in Microsoft's and Google's own words

Exchange Online (Outlook email). Microsoft's documentation: "The default deleted item retention period for Exchange Online is 14 days. You can modify this period for mailboxes up to a maximum of 30 days." Calendar items are kept for 120 days. After that, items are purged.

SharePoint and OneDrive. "A 93-day retention period spans both the first- and second-stage recycle bins. At the end of 93 days, the document is permanently deleted." It is 93 days in total, not 93 days per stage.

Google Drive. "If an item is in the trash for more than 30 days, Drive automatically permanently deletes it." A Workspace administrator can recover items "within 25 days after a user empties their trash." After that, Google can't bring it back.

Retention policies and legal holds change these numbers, but only if someone in your organization has set them up. Most small businesses we look at are running on the defaults.

Where the gaps bite

• Late discovery. A folder is deleted by mistake in March, and someone asks for it in July. The recycle bin emptied itself in June.
• Departed employees. An account is removed during offboarding, and months later a client asks for a file that only ever lived in that person's OneDrive.
• Ransomware and sync. An infected laptop encrypts local files, and the sync client faithfully uploads the encrypted versions.
• Disputes and litigation. When a dispute starts, the email you need is often older than any default window. Once it is purged, a forensic examiner has far less to work with.

Even Microsoft's own Services Agreement, the consumer one, says it plainly: "We recommend that you regularly backup Your Content and Data that you store on the Services." Business subscriptions run under separate terms. The principle doesn't change.

What a real backup looks like

CISA's #StopRansomware Guide (October 2023) puts it in one line: "Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario."

For a Microsoft 365 or Google Workspace business, that translates to:

• A copy outside your tenant. Retention policies keep data inside the same Microsoft or Google account that an attacker or a mistaken admin can reach. A backup should live somewhere else.
• Separate credentials. If your global admin account is compromised, the attacker should not be able to delete your backups with it.
• Coverage of everything that matters. That means mail, OneDrive, SharePoint and the files behind Teams; on Google, Gmail, My Drive and shared drives. People forget shared drives most often.
• Retention set by your needs. Decide how far back you need to go for your contracts, your regulator or your lawyer, then set retention to match. Don't settle for the defaults.
• Restore tests on the calendar. A backup you have never restored from is a hope. Restore a mailbox and a folder every quarter and write down how long it took.

For servers and line-of-business systems, the same logic applies. We compared the options in cloud vs on-premise backup for Colorado businesses.

Five questions to ask whoever runs your IT

1. If I delete a folder today and need it in six months, where does it come from?
2. When we offboard an employee, what happens to their mailbox and files, and for how long?
3. Is our backup stored outside our Microsoft or Google tenant, under different credentials?
4. When did we last test a restore, and how long did it take?
5. If ransomware hit a laptop this afternoon, which version of our files would we restore to?

If the answers are vague, that is your gap.

Where we fit

We set up and run backups for Microsoft 365 and Google Workspace as part of our data management and managed IT support work: an independent copy, separate credentials, retention you choose, and restore tests we actually perform and report. When we moved a Colorado healthcare provider off end-of-life servers to a hybrid cloud, the design included geo-redundant backup and a defined recovery-time target.

Frequently asked questions

Doesn't Microsoft keep copies in several data centers? Microsoft replicates data so the service stays up when its own hardware fails. Those copies protect the service. They don't give you a restore point for something your own team deleted or something ransomware overwrote.

Is the recycle bin enough? For yesterday's mistakes, often yes. For anything you notice after 14 to 93 days, depending on the service, no.

Can retention policies replace a backup? They help, and they matter for compliance and legal holds. But they keep data inside the same tenant, under the same admin accounts. A backup is a separate copy you can restore from when the tenant itself is the problem.

What does this cost? Backup for a small business is usually a modest per-user monthly cost. Ask us for a quote based on your user count and how far back you need to go.