An employee leaves. Their account is disabled the same week — routine offboarding practice.
Eight months later, someone needs a contract that person negotiated, or an email thread that explains why a project went off the rails. And they go looking. The mailbox is gone. The OneDrive folder is gone. Nothing was deleted on purpose — the standard retention period ran out weeks after the account was switched off, and everything in it was purged automatically, exactly as designed.
The reaction is almost always the same: “Isn’t all of that backed up? It must be in the cloud.”
It’s a common assumption. It’s also wrong.
What Microsoft promises
Microsoft’s job is to keep the Microsoft 365 platform running — the servers up, the service available, your email arriving. They’re very good at that. What they don’t promise is to get your data back after it’s deleted, whether that deletion was an accident, an offboarding, or something worse.
Microsoft clearly states, in the Microsoft Services Agreement: “We recommend that you regularly backup Your Content and Data that you store on the Services.” That’s not a hidden clause — Microsoft tells every customer, in plain language, that backup is the customer’s job, not theirs.
What “gone” looks like
What catches people off guard: Microsoft does keep deleted items around for a while. Just not as long as most people assume, and not in a form you can rely on months later.
Deleted email sits in a recoverable folder for 14 days by default — an admin can extend that to 30. After that, it’s purged.
Deleted OneDrive and SharePoint files move through a recycle bin with a 93-day total retention period — first stage, then second stage, and then permanently removed. If an administrator deletes an entire SharePoint site, every file in it goes with it.
Deleted Teams messages don’t have a retention period at all. There’s no recycle bin a user or an IT provider can open to get one back — once it’s deleted in the client, it’s gone unless the organization already had a compliance hold in place before the message was sent.
These retention periods are generous for the ordinary case — someone deletes the wrong thing by accident and notices the same afternoon. They were never built for “we didn’t notice for six months,” which is how a lot of data loss happens.
Where this shows up
The offboarding story above is one way. The others look different but end with the same result.
Accidental deletion that outlives the retention period. A folder gets deleted, cleaned out, or moved by mistake, and the mistake goes unnoticed until well past 93 days. At that point, the recycle bin isn’t a recovery option — it’s just history.
Ransomware. When ransomware encrypts files on someone’s computer, OneDrive’s sync engine picks up the change like any other edit, uploading the files to the cloud and overwriting the original versions. Canada’s Cyber Centre is clear about this in its guidance on backing up your information: a backup that stays connected to your systems can be caught up and changed by the same attack as everything else, which is exactly why they recommend copies stay offline until they’re needed.
A departing employee’s data, not handled correctly. Not everyone remembers to export what a leaving employee’s mailbox and OneDrive held before the account is disabled. Most of the time it’s never needed again. Occasionally it is — right after the retention period ends.
Deletion that wasn’t a mistake. Stolen credentials, or a disgruntled employee on their way out, deleting a mailbox or a folder on purpose. It doesn’t get flagged as a problem until whatever was in it turns out to matter.
None of these are rare edge cases. They’re the ordinary ways a normal day turns into a bad one.
What covers it
The fix isn’t complicated: a backup that runs on a daily schedule, stores copies outside Microsoft’s retention period, and lets you restore a single email, a folder, or a whole mailbox back to a specific point in time — not just whatever’s left in a recycle bin.
That’s the missing part our Microsoft 365 backup service is built to take care of — an independent copy of your email and files that a missed retention period, a bad actor, a disgruntled employee, or a plain mistake can’t touch. Worth setting up now, before you need it, not after.
If you’re not sure whether your Microsoft 365 data is protected, book a call with us — we’ll tell you honestly what’s covered and what isn’t.
