Key takeaways

  • Deleted SharePoint and OneDrive items are kept for 93 days across two recycle bin stages, then permanently deleted.
  • Microsoft keeps a further 14 days of SharePoint backups, reachable only through Microsoft support as a whole-site restore.
  • Deleted Exchange email is recoverable for 14 days by default, which administrators can extend to 30.
  • Retention is not the same as backup. A separate Microsoft 365 backup gives you independent, longer-term restore points.

Availability isn't backup

Microsoft runs a highly resilient service. Your mailbox and files are replicated, so a hardware failure in a data centre doesn't take you offline. What it doesn't do by default is keep every version of your data indefinitely.

If a file is deleted, overwritten or encrypted by ransomware and nobody notices for a few months, the built-in safety nets may already have expired.

How long Microsoft 365 keeps deleted items

  • SharePoint and OneDrive: deleted items go to the site Recycle Bin, then the second-stage (site collection) Recycle Bin, for a total of 93 days from deletion. The second stage can purge items early if it exceeds its quota.
  • SharePoint backups: Microsoft retains backups for 14 days beyond deletion, and you can ask Microsoft support for a full site collection restore within that window. This restores the site to a point in time, not a single file.
  • Exchange Online: deleted items are recoverable for 14 days by default, which administrators can extend to 30.

These are default behaviours. Retention policies and labels can change them, so check how your own tenant is configured.

Where the gaps appear

  • A staff member leaves, their account is removed, and their OneDrive is deleted once its retention period ends.
  • Ransomware encrypts files on a laptop, and the encrypted versions sync to OneDrive and SharePoint.
  • Someone deletes a folder and it's only noticed months later at end of financial year.
  • An attacker with admin access deletes data and empties the recycle bins.

Retention policies help, but they aren't a backup

Microsoft Purview retention policies can preserve content for years and are useful for compliance. But they live inside the same tenant, are controlled by the same admin accounts, and restoring from them isn't as simple as choosing a point in time. A backup stored outside Microsoft 365 gives you an independent copy.

What a good Microsoft 365 backup covers

  • Exchange mailboxes, including shared mailboxes and calendars
  • OneDrive for every user, including staff who have left
  • SharePoint sites and Teams files
  • Automated daily (or more frequent) backups
  • Restores of single items as well as whole mailboxes or sites
  • Storage outside your Microsoft tenant, with separate credentials and MFA
  • Regular test restores

Common questions

Does Microsoft back up my Microsoft 365 data?

Microsoft protects the service and keeps deleted items for limited periods, but by default it does not provide long-term, point-in-time backups of your data. For that you need a separate backup.

How long can I recover deleted OneDrive files?

By default, up to 93 days from deletion, across the first- and second-stage recycle bins.

Can I recover a deleted email after 30 days?

Not from the default recoverable items. Unless a retention policy or hold applies, or you have a separate backup, it is gone once the retention period ends.

Reviewed by Graham Graieg and Dane, Triad Networking Services. Graham and Dane look after IT, phones and security for Triad's medical and business clients across South East Queensland. Meet the team.

Sources

  1. Microsoft Learn, SharePoint and OneDrive data resiliency in Microsoft 365
  2. Microsoft Learn, SharePoint data deletion in Microsoft 365
  3. Microsoft Support, Restore deleted items from the site collection recycle bin
  4. Microsoft Learn, Recoverable Items folder in Exchange Online

General information only, current as of 6 October 2026. It isn't legal or compliance advice for your specific situation.