restowbackup
Try demoBuy license

Does Microsoft 365 back up your data?

Microsoft keeps Microsoft 365 running and resilient, but that is not a backup you can restore from on demand. What you can recover yourself comes from recycle bins, version history and retention settings, and those have time limits: for example 14 days by default (up to 30) for deleted Exchange Online items and 93 days for the SharePoint and OneDrive recycle bins. Under Microsoft's shared responsibility model your data remains yours to protect, and Microsoft sells a separate paid product, Microsoft 365 Backup, for backup and restore.

Lucas Flores By , IT Systeme Flores UG. Last updated

What does Microsoft do, and what are you responsible for?

Microsoft runs the service: the datacenters, the replication and the availability. Microsoft's documentation on the shared responsibility model says that for every kind of cloud service, including software as a service such as Microsoft 365, you own your data and identities and are responsible for protecting them.

In practice that means deciding who may delete data, how long deleted data should stay recoverable and how you would get back after a mistake, a taken-over account or a tenant-wide deletion. That page is guidance, not a contract term: what binds you is your agreement with Microsoft.

How long does Microsoft 365 keep deleted data?

These are the windows documented by Microsoft, read on 15 October 2026. Administrators can change some of them, and a hold or a retention policy can extend what is kept (see the next section).

Where What it keeps How long by default Good to know
Exchange Online: Recoverable Items folder Items deleted from the Deleted Items folder, or deleted with Shift+Delete 14 days; an administrator can raise it to 30 Calendar items in it are purged after 120 days by default. The folder has a quota (by default a soft limit of 20 GB and a hard limit of 30 GB); if it reaches its warning quota before the period ends, the oldest items are purged first.
Exchange Online: deleted user mailbox The mailbox of a deleted user account 30 days, then permanently deleted The same 30 days apply after an Exchange Online license is removed from a user.
SharePoint: site recycle bin and second-stage bin Deleted files, lists and items 93 days in total across both stages Items deleted from the second-stage bin are purged at once. If it exceeds its quota, the oldest items are purged first.
SharePoint: deleted site collection A deleted site collection with its sites and content 93 days After that the sites and their content are permanently deleted.
SharePoint: Microsoft's own backups Backups kept for a full site collection or subsite restore 14 more days beyond the deletion Not self-service: a restore is requested from Microsoft support.
OneDrive: recycle bin Deleted files and folders 93 days for work or school accounts, 30 days for personal accounts For work or school accounts an administrator can change the retention setting.
SharePoint and OneDrive: version history Earlier versions of a file Up to 500 major versions, with no expiry The organization default applies to new libraries and OneDrive accounts; existing libraries are set individually, and administrators can change the limits.

Mail that a user simply keeps stays as long as the user keeps it. What this table cannot give you is anything older than its windows that no hold or backup preserved: a mail deleted in March is not in the Recoverable Items folder in June.

Are retention policies and litigation hold the same as a backup?

No, they are compliance tools. Microsoft describes retention policies and retention labels as a way to retain or delete data for compliance requirements, as part of a long-term data lifecycle strategy, and holds as a way to preserve content for a legal investigation. Both work by keeping a copy of changed or deleted content in a hidden place, such as the Recoverable Items folder of a mailbox or the Preservation Hold library of a site, so that it is not purged.

That is preservation, not recovery. The same split, a store for recovery against a store for records, is the subject of backup vs. archive. There is no restore point that you can roll a mailbox or a site back to: you search for items and recover or export them. A compliance officer can use it to show what existed; an administrator who needs a mailbox as it was last Tuesday cannot simply restore it. Holds and policies are also administrator settings, so whoever controls the tenant controls them; Microsoft offers Preservation Lock to make a retention policy irreversible for regulated cases. Microsoft's own Microsoft 365 Backup documentation says that retention and deletion policies do not affect the backup recovery window, which stays isolated from them.

What is Microsoft 365 Backup?

Microsoft 365 Backup is Microsoft's own paid backup product. Facts from Microsoft's overview page, read on 15 October 2026:

It is a backup in the sense that it keeps restore points you can roll back to. It also sits by design inside Microsoft's boundary, managed by the same administrators in the same admin center. Whether that fits depends on whether you want the backup under the same vendor or apart from it. For a fact-by-fact comparison see Restow compared with Microsoft 365 Backup, and for what backup costs per user what Microsoft 365 backup costs per user.

What does Microsoft's service agreement say about backups?

Section 6(b), "Service Availability", of the Microsoft Services Agreement says that Microsoft recommends you "regularly backup Your Content and Data" that you store on the services. That agreement covers Microsoft's consumer services and does not cover business offerings such as Microsoft 365 for organizations, which fall under separate commercial agreements. So read it as a statement of Microsoft's general position, not as a clause in your organization's contract. The version read for this page is the one effective on 30 September 2026.

When does a third-party backup matter?

Many small organizations get along with recycle bins and retention for ordinary mistakes. A separate backup starts to matter at the edges:

If you need to What the built-in tools give you What a separate backup adds
Get back something deleted months ago Recycle bins and the Recoverable Items folder: 14 to 93 days. Holds and retention policies help only if they were in place before the deletion. Restore points for as long as its retention rule keeps them.
Keep a copy outside the tenant, under separate credentials The live data and the built-in safety nets share the tenant's administrator accounts. A copy at another provider or site; see the 3-2-1 rule.
Recover data of a removed user or license The mailbox for 30 days, then it is permanently deleted. Data that stays for as long as the retention rule says, after the account is gone.
Meet a contract or a regulation that asks for a separate copy Depends on the requirement; read it. A separate backup, if the requirement asks for one.

None of this makes a third-party backup necessary for everyone. It depends on how far back you may need to go, who could delete data and what a lost mailbox would cost you.

How Restow handles this

What Restow backs up today

Exchange Online mail, calendar and contacts, OneDrive and SharePoint Online sites, incrementally through Microsoft Graph, plus IMAP mailboxes, into a repository you choose: local disk, S3-compatible object storage or an NFS share. A restore is granular or complete, into the same account or a different one, and non-destructive by default. Restore points are kept by a retention policy you set (see grandfather-father-son rotation); without a policy every restore point is kept. A weekly restore check reads a sample of each backup back and shows the result as recovery readiness. See Microsoft 365 and IMAP backup, restore and verification.

For SharePoint, every directory sync finds the tenant's sites (the sites behind Microsoft 365 groups and Teams included; personal sites are left to their owner's OneDrive), and each site becomes a protected object. A backup holds every document library, every list with its columns and the field values of each list item, and the site's description. In the restore explorer you can download libraries, folders, files, lists and items as a ZIP, put files and folders back into their original library or another library of a backed-up site, and put list items back into their original list as new items. Reading SharePoint needs a permission that mail and OneDrive did not, so an administrator of the tenant has to give a new admin consent; until then mail and OneDrive keep working, and the directory sync warns that sites are neither found nor backed up.

Since 0.4.5, the calendar and the conversations of Microsoft 365 groups, the groups behind Teams included, can be backed up as well. Groups are opt-in: no group is backed up until you switch on "Protect all Microsoft 365 groups" in the protection rules or include single groups. A backup holds the group's calendar and every post of every conversation as a mail message. A restore into a user's mailbox brings back events and conversations; a restore into the group itself brings back calendar events only, because Microsoft Graph lets no app post into a group conversation. It needs no new permission.

A backup is not an archive, and Restow keeps them apart. In Business and Service Provider a mail job can also archive Microsoft 365 mailboxes: since 0.4.4 by Microsoft Graph change notifications, which fetch each new mail within minutes of delivery, or by Exchange Online journaling, which copies the mail in transport. Graph capture is near-time and not complete: a mail deleted for good before Restow fetched it can be missing. A retention policy or litigation hold in your tenant keeps deleted mail long enough for the capture to catch it; Microsoft Graph offers no way to read such holds, so Restow cannot check them and an administrator confirms them per source, with ready-made Exchange Online PowerShell commands that show the state. Graph capture needs no new permission, and it was tested against a simulated Graph API, not a real tenant. See how mail gets into the archive.

What it does not do yet

  • Restow does not back up Teams chats and channel messages. Of a Microsoft 365 group it backs up the calendar and the conversations, not the attachments of calendar events. From a SharePoint site it does not back up the attachments of list items, the site's design, its navigation or its workflows. Permissions are kept as information and are never restored, and a deleted site or library is not recreated. Exchange public folders are out of scope for now.
  • Microsoft 365 backup and restore have not yet run against a real Microsoft 365 tenant in Restow's release checks: check 4 of the pipeline was skipped in every release so far, and Microsoft 365 is covered by tests against a simulated Graph API, SharePoint sites and group calendars and conversations included. Restow is a beta, so run it beside your existing backup until you have verified restores against your own data.
  • The first backup of a large tenant can take days, because Microsoft throttles the Graph API.

Where the data goes

Not into Microsoft's cloud. Restow is not built on Microsoft 365 Backup Storage; backups go to the storage you choose, with a separate key per tenant. See the roadmap for what is planned.

Frequently asked questions

Can I recover a deleted email after 30 days in Microsoft 365?

Not with the built-in recycle bin tools. Items deleted from the Deleted Items folder stay in the Recoverable Items folder for 14 days by default, up to 30 if an administrator raised it, and calendar items for 120 days. After that a mail is only recoverable if a hold or a retention policy was in place before it was deleted, or if a separate backup has it.

Is the Microsoft 365 recycle bin a backup?

No. It is a safety net with a time limit: 93 days for SharePoint and for OneDrive with a work or school account, 30 days for a personal OneDrive account. It holds deleted files, not restore points, and what leaves it is gone unless something else kept it.

What happens to a user's mailbox when I delete the user?

Exchange Online keeps the mailbox of a deleted user account for 30 days, during which you can restore the account. After that the mailbox is permanently deleted and cannot be recovered, unless a hold such as Litigation Hold was placed on it before the deletion.

Is Microsoft 365 Backup free?

No. According to Microsoft Learn it is billed pay as you go at $0.15 per GB per month of protected data, and restores are free. Check Microsoft's current pricing page, because prices change.

Do I need a backup if I already use retention policies?

Retention policies preserve content for compliance and do not give you restore points. If you only need to show what existed, they may be enough. If you need to restore a mailbox or a site to a known day, or keep a copy outside the tenant, you need a backup.

Sources

Read on 29 October 2026.

  1. Microsoft Learn: Shared responsibility in the cloud. Customer data and identities stay the customer's responsibility, also in SaaS
  2. Microsoft Learn: Recoverable Items folder in Exchange Online. 14 days by default and up to 30, calendar items 120 days, quotas
  3. Microsoft Learn: Delete or restore user mailboxes in Exchange Online. 30 days for a deleted user mailbox and after a license is removed
  4. Microsoft Learn: Microsoft 365 SharePoint data deletion. 93 days across both recycle bins, deleted site collections, and the 14 extra days for a support-assisted restore
  5. Microsoft Support: Restore deleted files or folders in OneDrive. 93 days for work or school accounts, 30 days for personal accounts
  6. Microsoft Learn: Set default organization version limits. The default limit of 500 major versions and how it applies
  7. Microsoft Learn: Learn about retention policies and labels to retain or delete. Retention as long-term data lifecycle management for compliance, and Preservation Lock
  8. Microsoft Learn: Overview of Microsoft 365 Backup. Workloads, recovery window and points, billing, append-only storage and scale limits
  9. Microsoft Services Agreement, section 6(b), effective 30 September 2026. The recommendation to back up, and the agreement's scope (consumer services)