Microsoft 365 Backup for Small Businesses: Native Retention vs Backup

Microsoft 365 protects your data against hardware failure and gives you short recovery windows for deleted items, but it does not give a small business a separate, point-in-time backup that it controls. For mailboxes, deleted items are recoverable for 14 days by default (up to 30), and for SharePoint and OneDrive files the recycle bins hold items for 93 days. If you need to roll back after ransomware, a malicious admin, or a mistake noticed months later, add Microsoft 365 Backup or a third-party backup service.

Who this is for and what you will have

This is for owners and IT leads in small organisations who run on Exchange Online, SharePoint and OneDrive and want to know whether they need to buy backup. By the end you will know what each workload keeps natively, where those protections stop, how retention differs from backup, what Microsoft 365 Backup provides, and a decision checklist.

Two different things: recovery and backup

Microsoft 365 has built-in features that help you undo common mistakes. They are designed for the "I deleted that by accident" problem, and they have fixed windows. A backup is a separate copy of your data, held so that you can restore to a chosen point in time. Different failure scenarios need different tools:

What Exchange Online keeps

Exchange Online uses the Recoverable Items folder to protect against accidental or malicious deletion. Microsoft's documentation describes this flow:

1. A user deletes an item, and it goes to the Deleted Items folder.
2. The user empties Deleted Items, or presses Shift+Delete. The item is soft deleted and moves to the Deletions subfolder of Recoverable Items.
3. Users can recover it with Recover Deleted Items in Outlook or Outlook on the web.
4. The item stays until the deleted item retention period ends. The default is 14 days, and you can raise it for mailboxes to a maximum of 30 days. After that, the item is removed from Exchange Online.

Other details that matter:

• Single item recovery: if an item is purged from Deletions, it moves to a Purges subfolder where users can't recover it, but an admin can still recover it using an eDiscovery tool until the retention period expires.
• Calendar items are purged after 120 days by default when single item recovery behaviour applies, per the documentation's table.
• Quota: the default Recoverable Items quota is a soft limit of 20 GB and a hard limit of 30 GB. It rises automatically to 90 GB and 100 GB when the mailbox is on Litigation Hold, In-Place Hold, or covered by a Microsoft 365 retention policy.
• Folders deleted by a user are hard deleted, and the folder itself can't be recovered even under a hold, although its contents move to Recoverable Items and can be recovered for 14 days by default.

You can raise the retention window with PowerShell. The Microsoft documentation page titled "Change how long permanently deleted items are kept for an Exchange Online mailbox" describes the steps; read it before changing mailboxes in bulk. For how holds and retention interact, see Litigation Hold vs retention policy in Exchange Online.

Where this stops

After the window closes, a deleted email isn't in the mailbox. A mailbox on hold or under a retention policy keeps more (copies of modified and deleted items), but those features exist to preserve content for compliance and discovery, not to restore a whole mailbox to Tuesday at 9 a.m.

What SharePoint and OneDrive keep

Recycle bins

Microsoft explains the two stages for SharePoint in Microsoft 365:

• First stage: deleted items go to the site Recycle Bin and still count toward storage.
• Second stage: when someone empties the first stage or deletes from it, items move to the site collection Recycle Bin, which doesn't count toward storage.
• Retention: items are retained for 93 days from the time they're deleted from their original location, and the second stage holds them for the rest of that period unless purged earlier.
• Second-stage size: the space allocated is 200% of the site collection quota and can't be changed.
• Who can restore: site owners can restore from the site Recycle Bin, a site collection administrator can restore from the second-stage bin, and global or SharePoint admins can restore entire site collections.

OneDrive files are stored in SharePoint infrastructure, and Microsoft's page notes that deleting OneDrive files from a SharePoint site sends them to the site Recycle Bin too.

Restore your OneDrive

For OneDrive, Microsoft's Restore your OneDrive feature helps undo actions on files and folders within the last 30 days. For a work or school account, sign in to OneDrive on the web and go to Settings then Restore OneDrive, pick a date such as Yesterday or a custom date and time, review the activity chart and feed, and select Restore. After automatic ransomware detection a suggested date may be filled in.

Things to know:

• Files and folders created after the restore point go to the OneDrive Recycle Bin, where you can still restore them.
• If a file was permanently deleted from the OneDrive Recycle Bin, it can never be recovered.
• You can reverse a restore by running Restore again and selecting the action you want to undo.

For a worked scenario of a departing employee's data, see OneDrive access after a user leaves. Version history also helps with overwritten files; see SharePoint version history limits and trimming.

Retention policies are not backup

Microsoft Purview retention policies and labels let you retain what you need and delete what you don't. Their job is to meet record-keeping and regulatory rules: keep content for a set period, or delete it after one. Practical differences from a backup:

• A retention policy preserves a copy of content that was changed or deleted, but you don't restore an entire site or mailbox to a chosen moment with it.
• It is applied by policy scope, so gaps in scope are gaps in protection.
• Microsoft's backup documentation states that retention and deletion policies, for example from Purview, don't affect the backup recovery window, so the two are managed separately.

Use retention to meet obligations and Microsoft 365 Backup or a third-party tool to restore. See Purview retention policies guide for retention setup.

Microsoft 365 Backup: what it covers

Microsoft 365 Backup is Microsoft's own backup product for SharePoint sites, OneDrive accounts and Exchange mailboxes. From Microsoft's overview, read on 26 October 2026:

Further points from the overview:

• Backups are held within the Microsoft 365 data boundary and honour your data residency.
• Backup storage is append-only, so existing restore point data can't be altered by the service or malware, although an admin can delete backups by offboarding.
• After offboarding there is a fixed 90-day grace period in which you can recover the backups.
• A multi-admin email notification can alert a preset group of admins if a potentially harmful action is taken in the backup tool.
• After you activate a policy, it takes on average up to 60 minutes to process and another 60 minutes to create restore points.
• Restore speed varies. Microsoft publishes median expectations, for example restoring a single OneDrive or SharePoint protection unit with an express restore point in about 30 minutes. Treat them as medians, not guarantees.

Pricing and terms are listed as a pay-as-you-go model, unlike per-user licences. Confirm current rates in your admin centre before budgeting. As an illustration of the arithmetic only: protecting 500 GB at the listed rate would be 500 x 0.15 = 75 dollars per month, and 2 TB would be about 300 dollars per month. Your actual cost depends on the protected data size and current terms.

Partner backup tools

Microsoft also notes that independent software vendors build applications on the Microsoft 365 Backup Storage platform, where the operation of the tool is managed and paid for through the partner's application. Other vendors provide backup that stores copies outside Microsoft's service entirely. Whether you want an off-platform copy is a risk decision: Microsoft 365 Backup keeps data within the Microsoft 365 trust boundary, which is fast to restore but isn't a separate vendor's storage.

How to decide

Ask these questions:

1. What is the cost of losing a week of mail or files? If it is small, native windows may be enough.
2. How fast must you recover? For bulk restores after ransomware, point-in-time rollback beats restoring item by item from recycle bins.
3. How long before you'd notice a problem? If problems typically surface after months, 14 to 93 days of native recovery isn't enough.
4. Do you need data outside your Microsoft tenant? If a tenant-level incident is part of your risk model, choose a backup stored elsewhere.
5. What compliance duties do you have? Retention requirements are met with Purview policies, which is a separate task from backup.
6. How much data do you hold? Per-GB billing makes cost scale with data size.

A practical minimum for most small businesses: turn on sensible retention where required, confirm you know each recovery window, and run a backup that covers at least Exchange and OneDrive for staff and SharePoint sites that hold shared documents.

Set up and test

1. List what's critical: mailboxes, OneDrive accounts and SharePoint sites that hold business records.
2. Decide the recovery window you want, such as 1 year, and who is allowed to restore.
3. Enable your chosen backup and wait for restore points to appear.
4. Run a restore test on a non-critical site or mailbox, and time it.
5. Document the runbook: who restores, how to request it, where the audit trail is.
6. Set alerts: if your backup tool supports multi-admin notifications, enable them.
7. Review quarterly, and after major changes such as new sites or leavers.

Protect the admin accounts that can change backup settings, because an attacker with admin rights is the scenario where a backup matters most. Use multifactor authentication and separate admin accounts.

Troubleshooting recovery problems

Checklist

• Know the windows: Exchange 14 days default (30 max), recycle bins 93 days, OneDrive Restore 30 days.
• Don't treat retention policies as backup.
• Decide whether you need point-in-time restore, and for how long.
• Price backup by protected GB, and test restores before you need them.
• Protect the admin accounts that control recovery.

References

• Recoverable Items folder in Exchange Online (Microsoft Learn)
• How does the SharePoint recycle bin work? (Microsoft Support)
• Restore your OneDrive (Microsoft Support)
• Overview of Microsoft 365 Backup (Microsoft Learn)
• Learn about retention policies and labels (Microsoft Learn)