Last reviewed: October 27, 2026 · Reading time: 9 minutes
Most New York business owners we speak to assume Microsoft keeps a copy of everything in Microsoft 365, forever. It doesn’t. Microsoft runs an extremely resilient platform, but resilience and backup are two different jobs. Microsoft’s job is to keep the service running. Getting back a specific mailbox, file or Teams channel after it has been deleted, encrypted or overwritten is, under Microsoft’s shared responsibility model, largely yours.
This guide sets out the exact recovery windows that come with Microsoft 365, what happens when they run out, and the scenarios they were never designed to handle.
- Native recovery windows in Microsoft 365 range from 14 days (Exchange deleted items, by default) to 93 days (SharePoint and OneDrive recycle bins). After that, data is permanently purged.
- Native tools are built for accidental deletion, not for ransomware, malicious admins, or a departed employee whose account was removed months ago.
- Microsoft’s own Services Agreement recommends that customers regularly back up their content with a separate solution.
- New York regulators already treat Microsoft 365 configuration as your responsibility. NYDFS fined one insurance adjuster $2 million in 2025, in part over an Office 365 environment without MFA.
The shared responsibility model, in plain English
Microsoft is responsible for the infrastructure: data centers, hardware, replication between its sites, and keeping the service available. You are responsible for your data and how it is used: who can delete it, how long it is kept, and whether you can restore it to a known-good point in time.
That distinction matters because Microsoft’s replication is designed to keep the current state of your data available. If a user deletes a folder, or ransomware encrypts a synced OneDrive, that change is faithfully replicated too. Replication protects you from Microsoft losing a server. It does not protect you from your own tenant changing.
Every native recovery window, side by side
These are the default safety nets built into Microsoft 365. Some can be extended by an administrator, which is worth doing, but none of them turn Microsoft 365 into a point-in-time backup.
| Workload | What you can recover natively | Default window | Can it be extended? |
|---|---|---|---|
| Exchange Online | Deleted and purged email items (Recoverable Items) | 14 days | Up to 30 days via PowerShell, longer under retention policies or litigation hold |
| Exchange Online | A whole mailbox after the user is deleted (soft-deleted) | 30 days | Only with retention policies or holds |
| SharePoint and OneDrive | Individual deleted files via first- and second-stage recycle bins | 93 days in total | Generally not per site |
| SharePoint and OneDrive | Roll a whole library or OneDrive back to an earlier point (Files Restore) | Last 30 days | No |
| OneDrive (departed user) | The OneDrive of a user whose account was deleted | 30 days | Up to 3,650 days in the SharePoint admin centre |
| Teams | Undo a deleted chat message | Minutes | Longer-term recovery relies on retention policies and eDiscovery, not restore |
Five scenarios native tools don’t handle well
1. Ransomware that encrypts synced files
When ransomware reaches a laptop with OneDrive sync turned on, it encrypts local files and the encrypted versions sync straight back to the cloud. Files Restore can help if you notice within 30 days and the whole library is affected, but you lose everything that changed since the restore point, and mixed damage across many sites quickly becomes a manual job. Ransomware was present in 44% of breaches in Verizon’s 2025 Data Breach Investigations Report, and IDC cites an 88% share among small and mid-sized businesses in the same release.
2. The departed employee you need six months later
A partner leaves, their licence is removed to save cost, and 30 days later their mailbox and OneDrive are gone. Six months on, a client dispute needs an email thread only they had. Without a separate backup (or a deliberately configured retention policy), there is nothing to restore.
3. A compromised or malicious administrator
An attacker with Global Admin rights can delete data and empty recycle bins. Native recovery lives inside the same tenant the attacker controls. A backup held outside your tenant, with its own credentials and immutable storage, does not.
4. Slow-burn corruption
Some damage isn’t noticed for months: a sync conflict that overwrote a shared spreadsheet, or a migration script that stripped attachments. By the time anyone notices, the 30- and 93-day windows have closed.
5. Granular, point-in-time restores at scale
Restoring one user’s mailbox exactly as it was at 9am last Tuesday, or a single SharePoint site without rolling back everyone else’s work, is routine with a dedicated backup tool and difficult or impossible natively.
Why this is a New York compliance issue, not just an IT one
New York regulators already look closely at how firms run Microsoft 365. In August 2025 the Department of Financial Services entered a $2 million consent order with Healthplex. Among the alleged failures: MFA was not enabled for Office 365 web access after a migration, and there was no policy for disposing of sensitive data in the Office 365 environment. A single phished mailbox held more than 100,000 emails.
The lesson cuts both ways. Firms need to keep the right data (so they can restore it) and dispose of what they shouldn’t keep (so it can’t leak). A properly scoped backup policy, with defined retention per data type, helps with both. We cover the wider regulatory picture in our guide to compliance beyond the NY SHIELD Act.
Native tools vs a dedicated Microsoft 365 backup
| Capability | Native Microsoft 365 | Dedicated third-party backup |
|---|---|---|
| Copy stored outside your tenant | No | Yes |
| Point-in-time restore beyond 30 days | No | Yes, to your chosen retention |
| Immutable (cannot be deleted by an admin or attacker) | No | Yes, with immutable storage |
| Keep departed users’ data without paying for a licence | Limited | Yes |
| Granular restore (single item, folder, site, chat) | Partial | Yes |
| Restore to a different user or location | Manual | Yes |
A practical checklist for this quarter
- Extend what you can natively. Raise Exchange deleted-item retention to 30 days and extend departed-user OneDrive retention in the SharePoint admin centre.
- Turn on MFA everywhere, including web access and admin accounts. This was a central allegation in the Healthplex order.
- Add an independent backup for Exchange, OneDrive, SharePoint and Teams, stored outside your tenant on immutable storage. Our Microsoft 365 Backup and cloud-to-cloud backup services are built for this.
- Write down your retention rules by data type, so you keep what you must and dispose of what you shouldn’t.
- Test a restore every month. A backup you have never restored is a hope, not a plan. See why monthly testing is the new baseline.
Find out what your Microsoft 365 tenant can actually recover
Ron Klink will review your Microsoft 365 configuration, retention settings and recovery gaps, free of charge.
Sources
- CIAOPS, How to configure Microsoft 365 for maximum native data recovery, April 2025.
- Microsoft, Microsoft Services Agreement.
- Verizon, 2025 Data Breach Investigations Report, April 2025.
- Legal 500, Three key takeaways from the NY DFS Healthplex settlement, 2025.
