How Small Businesses Should Handle Microsoft 365 Backups

What Microsoft does and does not protect in Microsoft 365, how long deleted data is kept by default, and why a separate backup still matters.

Guide · By NexJen IT Solutions · Reviewed October 2026 · 4 min read
Key takeaways
Microsoft keeps deleted data only for limited windows: 93 days in SharePoint and OneDrive recycle bins, 14 days by default for deleted email.
Microsoft's own SharePoint backups restore whole site collections only, by support request, not single files.
An independent backup outside your tenant covers late-discovered deletions, ransomware and departed employees.

A common assumption is that because Microsoft 365 is in the cloud, Microsoft backs it up for you. Microsoft does keep the service running and stores data redundantly, but recovering from your own mistakes, a malicious insider or ransomware is largely your responsibility. Here is what the built-in protections cover, and where a separate backup fills the gaps.

What Microsoft keeps by default

• SharePoint and OneDrive: deleted files go to a recycle bin and are kept for 93 days from when they were deleted, across the first- and second-stage recycle bins.
• Deleted OneDrive accounts: when a user is removed, their OneDrive is kept for 30 days by default (an admin can change this), then stays in a deleted state for a further 93 days.
• Exchange Online email: deleted items can be recovered for 14 days by default, which an admin can extend to a maximum of 30 days.
• SharePoint service backups: Microsoft keeps backups for 14 days beyond deletion, but these restore whole site collections only, not individual files, and require a support request.

Retention policies and legal holds can keep data longer, but they are compliance tools, not a quick way to restore yesterday's version of a folder.

Where the gaps are

• Deletion discovered late: if no one notices a deleted folder until after the retention window, it is gone.
• Ransomware and mass changes: encrypted or overwritten files sync to the cloud. Version history helps, but rolling back thousands of files is slow.
• Departing employees: once the retention period for a removed user passes, their mailbox and OneDrive are permanently deleted.
• Malicious deletion: someone with admin rights can empty recycle bins.
• Granular restores: Microsoft's own service backups restore whole sites, not a single file or mailbox folder.

What a good Microsoft 365 backup looks like

• It is a separate service, outside your Microsoft 365 tenant, so a compromised admin account cannot delete it.
• It covers Exchange email, OneDrive, SharePoint and Teams for every user.
• It allows granular restores of a single file, folder, mailbox or message.
• Restores are tested, not assumed.
• Someone is responsible for monitoring that backups are succeeding.

Backup is one layer, not the whole plan

Backup is your last line of defense. MFA, endpoint protection with managed detection and response, and sensible sharing settings reduce the chance you will need it. Together they also make cyber insurance applications easier to answer honestly.

How we handle it

Every NexJen Essentials user's Exchange email, OneDrive, SharePoint and Teams data is backed up by a dedicated third-party backup service, separate from Microsoft's own short-term retention. If files are deleted, overwritten or encrypted by ransomware, we work to restore them from the backup. It is included in the $149 per user monthly price.

Common questions

Does Microsoft back up Microsoft 365 data?

Microsoft protects the service and keeps deleted data for limited periods, such as 93 days in the SharePoint and OneDrive recycle bins and 14 days by default for deleted email. It is not a substitute for an independent backup you control.

How long does Microsoft keep deleted emails?

By default, deleted items in Exchange Online can be recovered for 14 days. An admin can extend that to a maximum of 30 days.

Is OneDrive a backup?

No. OneDrive syncs files, so deletions and ransomware encryption sync too. Version history and the recycle bin help, but they are not an independent backup.

Is Microsoft 365 backup included with NexJen?

Yes. Microsoft 365 backup for every covered user is included in NexJen Essentials at $149 per user per month.

Sources
Restore deleted items from the site collection recycle bin (Microsoft Learn)Restore a deleted OneDrive (Microsoft Learn)Change how long permanently deleted items are kept for an Exchange Online mailbox (Microsoft Learn)SharePoint data deletion in Microsoft 365 (Microsoft Learn)

Know what is protected before you need it

NexJen Essentials includes Microsoft 365 backup by a separate third-party service, alongside endpoint protection and monitoring.

See whether NexJen Essentials fitsSee our managed IT services
Keep reading

Related guides

Security · Checklist

Microsoft 365 Security Best Practices for Small Businesses

A practical, prioritized checklist for securing a small business Microsoft 365 tenant: identity, email, devices, data, and monitoring.

4 min read
Read the guide →
Microsoft 365 · Comparison

SharePoint vs OneDrive vs Teams: Where Should Your Files Live?

OneDrive, SharePoint or Teams? Simple rules for where work files belong in Microsoft 365, with real scenarios and what happens when someone leaves.

5 min read
Read the guide →
Security · Checklist

How to Answer a Cyber Insurance Security Questionnaire

The security controls cyber insurance applications commonly ask about, how to answer accurately, and how to close gaps before renewal.

4 min read
Read the guide →
Browse all guides →

Want a second opinion on your setup?

Start with a free Security Snapshot. We'll tell you honestly what we find and whether we can help.

Get a free Security SnapshotSee pricing