Is the Microsoft 365 recycle bin a backup?
5 min read · Updated on 20 October 2026
Microsoft 365 keeps deleted files and emails for a while. Many organisations see that as their backup. It is not. This article explains what Microsoft 365 keeps by default and where the limits are.
What Microsoft 365 keeps by default
- SharePoint and OneDrive: a deleted item is kept for 93 days, counted from the moment of deletion. It first sits in the site recycle bin, then in the second-stage recycle bin. If you delete it there, it is gone immediately.
- Deleted SharePoint sites: also 93 days. After that the site and all its content are permanently deleted.
- Exchange Online: when you delete a message from Deleted Items, it moves to the Recoverable Items folder. It stays there for 14 days by default. Your IT administrator can extend this to a maximum of 30 days.
- Version history: SharePoint and OneDrive keep earlier versions of files when versioning is turned on. This lets you undo an unwanted change. It does not bring back a deleted file.
In addition, SharePoint keeps backups for 14 days after permanent deletion. You request a restore from them through Microsoft Support, and it applies to a whole site or subsite, not a single file.
Why this is not a backup
A recycle bin has a fixed period. If you only notice a mistake after four months, you are too late. Someone with the right permissions can also empty the recycle bin.
Retention policies in Microsoft Purview are not a backup either. They are meant for compliance. When content is changed or deleted, SharePoint keeps a copy in the hidden Preservation Hold library. You retrieve that copy through eDiscovery, not with a few clicks back to its original location.
Advice: think of it this way. Microsoft looks after the platform, and you look after being able to restore your own data. That is the idea of shared responsibility in the cloud.
Scenarios to consider
- Ransomware: encrypted files are synchronised to OneDrive or SharePoint. You then want to roll back a whole site or OneDrive to a moment before the attack.
- Accidental deletion: an employee deletes a folder and nobody notices within 93 days.
- Malicious intent: someone deliberately deletes data and also empties the recycle bin.
- Departed employee: an account is deleted and later it turns out that important files were stored in OneDrive.
The options
Microsoft 365 Backup is a Microsoft service for OneDrive, SharePoint and Exchange Online. You pay based on usage. You choose a retention period of 3 months, 6 months, 1 year or 2 years per policy. For OneDrive and SharePoint the service creates a restore point every 10 minutes for the first two weeks, then weekly. For Exchange Online it is every 10 minutes, going back 52 weeks. Backups are append-only and cannot be modified. They stay within the Microsoft 365 environment.
There are also backup solutions from other vendors. Some are built on the same Microsoft platform. Others store your data outside Microsoft. Have your IT administrator compare the options on retention period, what is protected and how quickly you can restore.
Checklist
- Decide how far back you need to be able to restore data.
- Set the retention period in Exchange Online to 30 days.
- Choose a backup for OneDrive, SharePoint and Exchange Online.
- Record who is allowed to carry out a restore.
- Test a restore of a file, a mailbox and a whole site at least twice a year.