Cloud
Microsoft 365's Recycle Bin Isn't a Backup Plan (Here's What Actually Is)
Microsoft's own documentation draws a clear line between the default recycle bin that comes with every Microsoft 365 subscription and Microsoft 365 Backup, the real backup product it sells separately. Here's what the built-in retention windows actually cover, what real backup adds, and how to make sure your business has genuine coverage.
Microsoft 365's built-in recycle bin and retention settings are not a backup plan. Microsoft's own documentation draws that line clearly, and the company sells a separate product, Microsoft 365 Backup, for exactly the gap between the two. Here's what's included by default, what real backup actually adds, and how to make sure your business has genuine coverage rather than just the default.
What's Included by Default
For SharePoint and OneDrive, a deleted file moves through a two-stage recycle bin and is retained for 93 days total from the time it was deleted, according to Microsoft's own service resiliency documentation. After that window, or sooner if the recycle bin exceeds its storage quota, the item is no longer available through the recycle bin.
SharePoint and OneDrive libraries also keep file version history, and a separate feature called Files Restore can roll an entire library back to any point in the last 30 days, which is useful for recovering from a mass deletion or corruption event rather than one file at a time. Files Restore covers the preceding 30 days; version history has its own configured limits, which can be a version count, an expiration period, or an automatic combination of both, depending on how the library is set up. Retention policies, labels, and holds can extend or override any of these defaults for a given tenant. None of this is a substitute for a backup product with a recovery window measured in months or years, and the specific settings that apply to your organization are worth confirming rather than assuming.
For Exchange Online mailboxes, a permanently deleted item is kept in the Recoverable Items folder for 14 days by default. Microsoft's documentation confirms an administrator can extend that, but only up to a maximum of 30 days. Putting a mailbox on litigation hold works differently than an extension: it suspends the normal retention limit rather than adding a fixed number of days on top of it. A finite hold duration determines how long each item is preserved, measured from when the message was received or the item was created; an indefinite hold preserves items until the hold itself is removed.
These built-in options exist to undo a recent, accidental deletion. They were never designed to be a full point-in-time restore of a mailbox or a site going back further than a few weeks or months, and their exact scope depends on how your tenant is configured.
What Microsoft 365 Backup Actually Adds
Microsoft sells its own answer to this gap: Microsoft 365 Backup, a separately configured product covering OneDrive, SharePoint, and Exchange. Unlike the default recycle bin, it offers a configurable recovery window (3 months, 6 months, 1 year, or 2 years), point-in-time restore for an entire site or mailbox, and append-only storage designed to resist overwrite by malware or a compromised account. It's billed separately from a standard license, on a pay-as-you-go basis, and it has to be deliberately turned on. According to Microsoft's own architecture documentation, Microsoft 365 Backup data stays within Microsoft's data trust boundary rather than being copied to outside infrastructure.
Some businesses use Microsoft 365 Backup directly for that reason. Others choose a third-party backup product instead, often to get a single view across more than one platform, or to keep a copy that doesn't depend on their primary Microsoft 365 tenant staying healthy. Both are legitimate, real backup. The built-in recycle bin, version history, and Files Restore, on their own, are not: they are a safety net for a recent mistake, not a deliberate backup strategy.
If your business has never turned on Microsoft 365 Backup or a comparable third-party product, those built-in, time- and configuration-bounded options are what you have to work with. Confirm the specific settings that apply to your tenant, and don't assume a standard subscription, or an untested backup product, already covers what your business actually needs.
Building a Real Continuity Plan
Confirm, rather than assume, whether Microsoft 365 Backup or a third-party backup product is actually configured for your organization, and for which services.
Check what recovery window it's set to, and whether that actually covers how far back your business might realistically need to look.
Test an actual restore, not just a report that backups are running. A backup nobody has ever restored from is a backup you don't really know works.
Ask specifically how restores work if Microsoft 365 itself is having a sign-in or access problem. A backup product that restores back into the same Microsoft 365 tenant depends on that tenant being reachable, so understand what your restore path actually requires before you need it under pressure.
Set up a way to communicate with staff and customers that doesn't depend on Microsoft 365 sign-in, separate from Teams and Outlook.
Learn where to check Microsoft 365 service health in the admin center, and make checking it a documented step when something looks wrong.
How Cyber One Solutions Can Help
Cyber One Solutions' Managed Cloud services monitor Microsoft 365 health and configuration on an ongoing basis, and our backup and disaster recovery services set up and maintain real backup coverage for Microsoft 365 email and files, tested and matched to a recovery window that fits your business, rather than leaving you dependent on the default recycle bin. If you are not sure what backup coverage your organization actually has today, our backup and DR readiness assessment is a fast way to find out, or you can contact Cyber One Solutions to talk through your specific environment.
The Bottom Line
Microsoft draws a clear line between the recycle bin that comes with every Microsoft 365 subscription and the backup product it sells separately, and that line is worth taking seriously. A 93-day window for files, or 14 to 30 days for email, is not the same as a real, tested backup with a recovery point that matches your business. Whether you use Microsoft's own Microsoft 365 Backup or a third-party alternative, the protection only exists once it's deliberately configured, and it's only proven once you've actually tested a restore.
Frequently Asked Questions
Does Microsoft Back Up My Microsoft 365 Data by Default?
Not with the recovery window a deliberate backup product provides. By default you have Microsoft's built-in recovery features (the recycle bin, file version history, and Files Restore for SharePoint and OneDrive, plus a shorter recovery window for Exchange email), which exist to undo a recent accidental deletion rather than serve as backup. Their exact scope and limits differ, and retention policies, labels, or holds can change what's actually available on your tenant. Microsoft's own Microsoft 365 Backup product exists specifically to close that gap with a configurable recovery window measured in months or years, but it has to be turned on and configured; it is not active automatically on a standard subscription. Check what's actually enabled for your organization rather than assuming.
What's the Difference Between Retention and Backup?
The default recycle bin and deleted-item retention windows exist to undo an accidental deletion within a short, mostly fixed window; that's separate from compliance retention policies, labels, and holds, which can preserve content for much longer for legal or regulatory reasons but aren't built for restoring a mailbox or site. Backup, whether it's Microsoft 365 Backup or a third-party product, offers a configurable recovery window and can restore an entire mailbox or site to a specific point in time, not just recover one item someone remembers deleting.
How Long Does the Default Recycle Bin Keep Deleted Items?
For SharePoint and OneDrive, 93 days total across the two-stage recycle bin. For Exchange Online mailboxes, 14 days by default, extendable by an administrator to a maximum of 30 days. A litigation hold works differently: a finite hold duration preserves each item for that many days from when it was received or created, and an indefinite hold preserves items until the hold itself is removed.
Does Microsoft 365 Backup Count as Real Backup, or Do I Still Need a Third-Party Tool?
Microsoft 365 Backup provides genuine backup functionality: a configurable recovery window, point-in-time restore, and immutable, append-only storage. Some businesses use it directly. Others choose a third-party tool instead, often for a unified view across more than one platform or to keep a copy that doesn't depend on their primary Microsoft 365 tenant. Either approach is legitimate as long as it's deliberately configured and its restores have actually been tested.
What Should I Do if Microsoft 365 Itself Goes Down?
A backup protects your data, but it doesn't restore access to Microsoft 365 during an outage on Microsoft's side, especially if the restore path depends on signing back into that same tenant. Check the Service Health page in the admin center, use a communication channel that doesn't depend on Microsoft 365 sign-in, and avoid unnecessary troubleshooting like password resets until Microsoft confirms the issue is resolved.