Microsoft 365 Is Not a Backup

A common assumption is that data in Microsoft 365 or Google Workspace is inherently safe, because it is in the cloud and the provider is a large company running redundant infrastructure. Both are true and neither is a backup. Cloud providers operate a shared responsibility model: they keep the platform available and protect it against their own hardware failures, while what happens to your content — deleted, overwritten, encrypted or removed by a departing employee — is largely on your side of the line.

Microsoft 365 provides several recovery layers, and they are useful: deleted items folders, a recoverable items area behind them, recycle bins in SharePoint and OneDrive, a window in which a deleted user account can be restored, and version history on files. They are also time-limited, and the defaults are measured in days or weeks rather than months.

The exact periods depend on your licensing and configuration, and they can be extended with retention policies, litigation hold or archiving. Check what yours are actually set to rather than assuming the defaults, because that number is the real answer to how far back you can go.

Deletions are often found long after they happen. A project folder cleared out months ago, mailboxes removed when staff left, a file overwritten with an empty version and saved. By the time someone needs the content, the retention window has quietly closed, and at that point Microsoft generally cannot help either — not because support is unhelpful, but because the data is no longer held.

The departing employee case is the most common of all. When an account is deleted and its licence is released to save cost, the mailbox and the personal OneDrive go with it after a grace period. That decision is usually made by whoever handles billing, without anyone asking what was stored there.

OneDrive and SharePoint sync clients do exactly what they are designed to do: when ransomware encrypts local files, the encrypted versions replicate upward and overwrite the good copies. Version history is the main defence here and it frequently works, but restoring thousands of files version by version is slow, and version history has its own limits. A copy held outside the tenant, which the tenant's own credentials cannot reach, is what makes this straightforward instead.

This is where there is often more room than people assume, because the cloud is usually not the only copy. Outlook keeps a cached OST file on each machine that used the account, and that file frequently contains mail that no longer exists in the tenant — including from accounts that have been deleted entirely. OneDrive and SharePoint synced folders leave local copies on laptops and desktops, and deleted local files may still be recoverable from the drive itself.

So the first questions after a cloud deletion are practical ones: which machines had that account signed in, are those machines still around, and have they been reimaged or reissued? An OST file on a laptop in a cupboard is a very common route to mail that Microsoft no longer holds. If a machine is a candidate, stop using it, because continued use overwrites deleted data.

The durable fix is a third-party backup of the tenant, holding mail, OneDrive, SharePoint and Teams content on retention you choose, in a location the tenant's credentials cannot delete. That covers accidental deletion, the departing employee, ransomware sync and an administrator account compromise, all of which the platform's own recycle bins only partly address.

It is also worth separating the decision to remove a licence from the decision to destroy the data. Exporting a leaver's mailbox and personal files before the account is deleted takes minutes and removes an entire category of problem.

Check the recycle bins, recoverable items and deleted user list first, since a recent deletion may simply be restorable. If the window has passed, the local machines are the next place to look, and preserving them matters more than searching them. We can tell you whether a cached copy is likely to exist and what it would contain, and we will say when the honest answer is that it does not.