Are the recycle bin and version history in Microsoft 365 enough? Which retention periods apply, where the limits are and when businesses need additional backup.
September 22, 2026
oneCorp Team
Recycle bins keep deleted files for 93 days and deleted emails for 14 days by default; entire OneDrive accounts and libraries can be rolled back for 30 days. For losses noticed late, large-scale damage or a separate copy, you need additional backup with tested recovery.
An accidentally deleted email, an overwritten spreadsheet or a missing project folder: data loss often starts with an everyday mistake. If you work with Microsoft 365, you already have several ways to recover from situations like these.
The blanket statement “Microsoft doesn't back up your data” therefore falls short. What matters is which data can be restored, for how long and with how much effort. For a file deleted yesterday, the recycle bin may be enough. For a loss noticed months later, or for restoring many workspaces at once, the requirements are different.
This guide explains what the built-in features do, where their limits are and when additional backup for Microsoft 365 makes sense.
Microsoft 365 comes with several protection mechanisms. They serve different purposes and have their own time limits – there is no single retention period for all company data.
| Feature | Typical use case | Time window and limits |
|---|---|---|
| Exchange Online: Recoverable Items | An email was also removed from “Deleted Items” | 14 days by default, extendable by admins to up to 30 days |
| SharePoint recycle bin | Files or folders were deleted | 93 days in total from the original deletion across both recycle bin stages; earlier permanent deletion is possible |
| OneDrive recycle bin (work or school accounts) | Accidentally deleted files | 93 days by default, unless the administrator has changed the setting |
| Restore your OneDrive | Many files were changed, overwritten or damaged | Undo all file and folder actions within the last 30 days |
| Restore a SharePoint library | Extensive unwanted changes in a shared library | Undo all actions within the last 30 days |
| Version history | An earlier version of a file is needed | Depends on the configured version limits |
Sources: Microsoft documentation on Exchange Online, SharePoint recycle bins, OneDrive recycle bins, restoring OneDrive, restoring libraries and version limits.
Important for SharePoint: The second-stage recycle bin does not start a new 93-day period; what counts is the time of the original deletion. If the second-stage quota is exceeded or an administrator empties it, content can disappear permanently even earlier. Microsoft also keeps its own backups for another 14 days. However, only Microsoft Support can restore from them – and only complete site collections, not individual files or libraries.
With version history, the actual configuration matters. Automatic rules can thin out older versions, manual rules limit their number or age. Versions removed this way do not go to the recycle bin but are permanently deleted. “Versioning is turned on” therefore does not answer which version of a file will actually be available later.
For clearly limited everyday mistakes, the built-in tools are often the fastest route:
The built-in features can be sufficient for such cases if the mistake is noticed in time, the data is still there and the recovery path is known. However, they do not automatically cover all of a company's failure scenarios.
Microsoft protects its services against failures of its own infrastructure. That ensures availability, but it does not answer the core question of a backup: can a specific, earlier and intact state of your data be brought back? Microsoft itself makes clear that its disaster recovery copies maintain the current state of content, not earlier versions (Microsoft: Backup FAQ).
Retention policies serve a purpose of their own, too. Microsoft Purview lets you retain or delete content according to defined rules (Microsoft: Data Lifecycle Management). But finding and exporting retained content is something different from quickly getting an affected workspace back to work. Microsoft, for example, describes legal holds as optimized for export, not for mass restore.
The shared responsibility model applies in principle: even with cloud services, customers remain responsible for their own data and identities (Microsoft: Shared Responsibility). For planning purposes, answer two questions separately: Which information must be preserved – and how will operations be restored after data loss?
Not every missing file is noticed immediately. A completed project folder may not be needed until the next follow-up order. If a deletion is noticed after four months, it is outside the 93-day recycle bin window. Without suitable retention or backup, the content is then gone.
A backup only helps in this case if the data was backed up before the loss and the required state is still within the chosen retention period.
A single document is quickly restored. If numerous mailboxes, OneDrive accounts or SharePoint sites are affected – for example after a ransomware attack or a faulty synchronization –, coordination and time become critical. For business-critical areas, define two targets:
Only a recovery test under realistic conditions shows whether these targets are met – a successfully completed backup job alone does not prove it.
If a privileged account is compromised, it should be clear what impact that has on backups. Separate roles, protected admin access, deletion protection and documented emergency access are relevant here. If your company needs a copy outside the Microsoft infrastructure, the chosen solution must explicitly provide it. A different software vendor does not automatically mean a different storage location – what matters is the architecture behind the offering.
With Microsoft 365 Backup, Microsoft itself offers a paid backup service. It backs up selected or all SharePoint sites, OneDrive accounts and Exchange mailboxes. Backups remain within the Microsoft 365 data boundary – they are stored on the same platform as the original data and are not an independent copy (Microsoft: Overview).
Key facts according to the current documentation:
Microsoft 365 Backup is therefore one possible answer to additional backup requirements – especially when it comes to longer recovery windows and fast mass restore within Microsoft 365. Whether the service fits depends on the data types you need and your requirements for separation from the production environment.
The choice should be based on concrete requirements. These questions help with the comparison:
| Question | What matters |
|---|---|
| Which data is protected? | Check mailboxes, archives, SharePoint, OneDrive and Teams individually |
| What can be restored? | Individual items, folders, complete workspaces and associated permissions |
| How long are restore points kept? | Required retention and available points in time within that window |
| Where are the backups stored? | Microsoft infrastructure, a separate cloud or your own data center |
| Who can change or delete backups? | Roles, authentication, deletion protection and emergency procedures |
| What happens if Microsoft 365 is disrupted? | Access to the backup as well as possible export and restore targets |
| Who is responsible for recovery? | Responsibility, availability, tests and agreed services |
The statement “Teams is backed up” deserves particular attention. Teams combines chats, channels, files, memberships and settings from different services. Backing up the associated files is not yet a complete restore of chats and channels. Popular third-party solutions do not cover everything here either: Veeam Backup for Microsoft 365, for example, backs up Teams channel posts and files, but currently not one-on-one or group chats (Veeam: Limitations). Ask to be shown the supported scope of any solution in concrete terms.
An external backup does not guarantee either that employees can keep working immediately if Microsoft 365 fails. For that, data access and alternative workflows must be prepared.
When comparing offers, consider not only the storage or license price but also setup, monitoring and the actual execution of restores.
For its own service, Microsoft lists a price of USD 0.15 per GB of protected content per month; restores incur no additional charges (Microsoft: Pricing model). With a constant billable volume of 1,000 GB, that works out to USD 150 per month. More than the visible file inventory is billed, though: online archives, the second-stage recycle bin and deleted and versioned items in protected mailboxes are added, among other things.
Managed backup offerings from IT service providers often use other platforms, storage locations and pricing models, for example per terabyte. Compare on the same data basis and with the same scope of services. A cheap offer is worth little if nobody performs the restore in an emergency or important data types are missing.
Start with an inventory: Which mailboxes and file stores are business-critical? Which version, retention and backup rules actually apply there? Then test three cases:
Document completeness, permissions, effort and responsibilities. Use test data so that productive changes are not rolled back unintentionally. Only this check shows whether the existing recovery options are sufficient or additional protection is needed. Why tested restores belong in every backup strategy is also explained in our article on the 3-2-1 backup rule.
The recycle bin, version history and the recovery features of Microsoft 365 help with many everyday mistakes – within their time limits. For losses noticed late, large-scale damage or a separate copy, you need additional backup with clearly defined retention, tested recovery and assigned responsibility.
oneCorp backs up Microsoft 365 data with Veeam Backup for Microsoft 365 on its own servers in a German data center – separate from the Microsoft infrastructure. Together we clarify which mailboxes, file stores and Teams content need protection, how long earlier states should remain available and who takes care of recovery in an emergency. Learn more about Backup as a Service and support for your Microsoft 365 environment.
As of October 2026. Features, retention periods and prices of Microsoft and Veeam change regularly and depend on license and configuration; the current vendor documentation is authoritative. “Microsoft 365 Backup” in this article refers to Microsoft's service.
