Microsoft 365 retention vs backup: the main built-in limits in one table

Microsoft 365’s built-in recovery features are time-limited safety nets, not backups. Deleted SharePoint and OneDrive files can be recovered for up to 93 days, deleted Exchange Online email for 14 days by default (30 at most), and deleted users, groups and Teams for 30 days. After those windows, the content is permanently deleted, unless a compliance retention policy or hold has kept a copy for search and export.

Written by Sophie Evans, Sales and Marketing Executive, reviewed by Dan Taylor, Backup and Disaster Recovery EngineerLast reviewed
The limits

The main built-in recovery windows in one table

Under Microsoft’s shared responsibility model, the data inside your tenant is yours to protect. These are the windows Microsoft 365 gives you to undo a deletion or a bad change, with the Microsoft page each figure comes from.

What’s lostHow long you can get it backSource
A file deleted from SharePoint93 days, across both recycle bin stagesMicrosoft Support
A file deleted from OneDrive (work or school)93 days, unless your admin changed itMicrosoft Support
A whole SharePoint site93 daysMicrosoft Learn
A SharePoint library changed or corruptedRoll back up to 30 daysMicrosoft Support
A OneDrive changed or corruptedRoll back up to 30 daysMicrosoft Support
An email deleted from Deleted Items14 days by default, 30 at mostMicrosoft Learn
A deleted user account and mailbox30 daysMicrosoft Learn
A leaver’s OneDrive30 days by default (configurable), then 93 days in the site collection recycle binMicrosoft Learn
A deleted Microsoft 365 group or Team30 daysMicrosoft Learn
Retention

Retention policies are not a restore button

Microsoft Purview retention policies and retention labels are often mistaken for backup. Microsoft describes their purpose as helping you “retain what you need and delete what you don’t”. Content they keep is held for compliance, search and eDiscovery, for example in a site’s Preservation Hold library.

That is a compliance job. Putting a deleted mailbox, site or Team back the way it was is a recovery job, and that is what a backup is for.

Microsoft’s own option

What about Microsoft 365 Backup?

Microsoft also sells Microsoft 365 Backup, a separate pay-as-you-go service that isn’t included in Microsoft 365 licences. It backs up SharePoint sites, OneDrive accounts and Exchange Online mailboxes, with a recovery window you can set to 3 months, 6 months, 1 year or 2 years. Microsoft’s pricing page gives a list price of $0.15 per GB per month of protected content (checked 28 October 2026), and Microsoft says restores are free.

By Microsoft’s own description, those backups are kept inside the Microsoft 365 data boundary, alongside the data they protect. It is a real backup, not a recycle bin, but it is still one provider holding both copies, and it covers only those three services.

CloudVision is priced per user rather than per GB, with up to 250 GB of backup storage for each user or mailbox, so your bill doesn’t grow as mailboxes and OneDrives fill up within that allowance.

The catch

Where the built-in windows fall short

  • Problems found late. If nobody notices a deletion or a bad sync until after the window closes, the built-in tools can’t bring it back.
  • Leavers. A departed user’s account and mailbox can be restored for 30 days, and their OneDrive is kept for 30 days by default before it moves to the recycle bin.
  • Emptied recycle bins. Items removed from the site collection recycle bin, by manual deletion or by emptying it, can’t be recovered with Restore this library.
  • Full Recoverable Items folders. The Exchange Online Recoverable Items folder has its own quota. When it reaches the warning quota, items are purged oldest first.
Side by side

Built-in recovery vs an independent backup

Compared onBuilt-in Microsoft 365 recoveryIndependent backup (CloudVision)
Where the copy livesInside your Microsoft 365 tenantOutside Microsoft 365, in ISO 27001 certified, SOC 2 Type 2 audited data centres
How far backFixed windows of 14 to 93 daysConfigurable to your policy
After a recycle bin is emptiedCan’t be restored with the built-in toolsStill in the backup
Who restoresYour admins or users, within the windowCloudVision’s UK team, 24/7
Daily record of what was backed upNone built inThe CloudVision Daily Backup Report, object by object
How CloudVision handles this

An independent backup, checked every day

CloudVision keeps an independent backup of every Exchange Online mailbox, OneDrive, SharePoint site and Team, as frequently as real time, and checks each one against a 24-hour backup SLA. Retention is configurable to your policy, so you aren’t limited to the windows above, and our UK team handles every restore. See managed Microsoft 365 backup and the CloudVision Daily Backup Report.

FAQ

Microsoft 365 retention: common questions

How long does Microsoft 365 keep deleted emails?

14 days by default. Once an item is deleted from the Deleted Items folder, it stays in the Recoverable Items folder for the deleted item retention period, which admins can raise to a maximum of 30 days. When that period expires, the item is removed from Exchange Online.

How long does the SharePoint and OneDrive recycle bin keep files?

93 days. For SharePoint, the 93 days run from the moment the item was deleted, across both recycle bin stages. For OneDrive work or school accounts it is also 93 days, unless your admin has changed the setting. After that, files are permanently deleted.

What happens to a leaver's OneDrive and mailbox?

A deleted user’s account and mailbox can be restored for 30 days. Their OneDrive is kept for 30 days by default (admins can change this), then moves to the site collection recycle bin for 93 days before it is deleted.

Are Microsoft 365 retention policies a backup?

No. Microsoft describes retention policies and labels as a way to retain what you need and delete what you don’t, for compliance. They are a compliance tool, not a recovery tool: putting a deleted mailbox, site or Team back the way it was is what a backup is for.

Does Microsoft offer its own Microsoft 365 backup?

Yes. Microsoft 365 Backup is a separate pay-as-you-go service. Microsoft’s pricing page gives a list price of $0.15 per GB per month of protected content (checked 28 October 2026). It covers SharePoint sites, OneDrive accounts and Exchange Online mailboxes, with a recovery window of up to 2 years, and keeps the backups inside the Microsoft 365 data boundary rather than with an independent provider.

Sources

Microsoft documentation used in this guide

This guide is general information, not legal or insurance advice. Requirements and product limits change, so check the linked sources and your own policies, and take professional advice where needed. Sources last checked on 28 October 2026.

Ready to get protected?

Test us on your own data, free for 30 days.

Set up for you on a selection of your users, with no card and no commitment. On day 7 we restore a file you choose and send you the timed result, before you pay anything.

Prefer to talk first? Book a 15-minute demo.

Start My Free Trial