Partly. Microsoft 365 keeps deleted emails, deleted files and older versions of your files for a set number of days, and that comes with the subscription at no extra cost. When those days run out, the item is gone, unless your admin has set a retention policy, which we come to below.
What the subscription does not give you is a backup in the usual sense: a separate copy of everything, from which you could put the whole company’s email and files back the way they were last week. Microsoft sells that as a paid add-on called Microsoft 365 Backup. Even the add-on is built for mail and files. Microsoft’s overview of it names no admin settings.
This guide is for the owner or office manager who holds the Microsoft 365 admin login and has no IT team behind them. It covers what Microsoft keeps and for how long, where that protection stops, what the paid add-on costs, and the small plan we would put in place for a business of 5 to 50 people.
Two words first. Your tenant is your company’s whole Microsoft 365 account: every user, every mailbox, every file, and every setting your admin has made. A restore is putting something back from a saved copy.
What Microsoft 365 keeps for you, and for how long
Your data lives in three places. Exchange Online is the email service: every mailbox, calendar and contact list. OneDrive is each person’s own file space. SharePoint Online holds the shared files your team works on together.
Each of the three has its own safety net, and each net has its own time limit.
| What was lost | Where it waits | How long |
|---|---|---|
| A deleted email | The mailbox’s Recoverable Items folder, a hidden folder for deleted mail | 14 days by default. An admin can raise it to 30 days at most. |
| A deleted file in a work OneDrive | The OneDrive recycle bin | 93 days, unless your admin changed the setting |
| An earlier version of a OneDrive file | The file’s version history | 30 days. Your admin may have turned versions off. |
| An earlier version of a SharePoint document | The library’s version history | The last 500 versions, in a library created in Microsoft 365 with versioning on by default |
| Safety net | Days you can get an item back |
|---|---|
| Deleted email, default | 14 days |
| Deleted email, admin max | 30 days |
| OneDrive file versions | 30 days |
| OneDrive recycle bin | 93 days |
| Paid Microsoft 365 Backup | 365 days |
Two details in the small print matter more than they look.
The email window can close early. The Recoverable Items folder has a size limit. If it fills before the 14 days are up, Microsoft deletes the oldest messages first to make room.
Check the second recycle bin before you give up. Microsoft’s OneDrive help says a file that has been permanently deleted from the recycle bin cannot be restored. On a work account there is a second recycle bin behind the first one, which Microsoft calls the second-stage recycle bin. What someone empties from the first bin goes there, and a person with admin rights can restore it from there. So ask your admin before you give up on a file.
What Microsoft does not promise
The safety nets above are built for one person getting one thing back. Someone deletes a folder by mistake on Monday and wants it back on Wednesday.
They are not built for the day everything goes wrong at once. Two examples.
Ransomware. Ransomware is software that scrambles your files so they cannot be opened, then demands money to unscramble them. Say it reaches a shared folder that syncs to OneDrive. A great many files change at once. Version history may still hold the older copies. In OneDrive it holds them for 30 days, and only where your admin has not turned versions off. OneDrive also has a Restore your OneDrive option, which rolls one person’s whole OneDrive back to any point in the last 30 days, undoing every change to its files and folders at once. That suits the day many files changed together. If nobody notices the damage for a month, both of those nets are empty.
A bad admin day. Say an account with admin rights is misused, or a well-meaning admin deletes the wrong user or changes the wrong setting. The recycle bins and version history are about items, not about how your tenant was set up. None of them puts your settings back.
None of the Microsoft help pages behind those time limits describes a way to roll your whole tenant back to how it stood on a given day. If you want that, you have to plan for it.
Retention policies keep copies, not a way back
Microsoft Purview retention policies sound like a backup, and they are not one. A retention policy is a rule your admin sets that says “keep this kind of content for this long, even if someone deletes it”.
When someone edits or deletes content a policy covers, Microsoft keeps a copy. For SharePoint and OneDrive the copy goes into a hidden library called the Preservation Hold library. For mail it goes into the Recoverable Items folder from the table above.
A retention copy is kept for the record. It does not put the office back as it was. Microsoft’s retention page describes keeping copies. It does not describe putting a site or a mailbox back the way it was.
One cost to know before you switch it on: the Preservation Hold library counts against your site’s storage. Microsoft’s own page says you might need to increase your storage once retention settings are on.
Microsoft 365 Backup: the paid add-on, and what it costs
Microsoft 365 Backup is Microsoft’s own answer to the gap. It backs up all or some of your SharePoint sites, OneDrive accounts and Exchange mailboxes, and it is offered through the Microsoft 365 admin center.
It works with restore points, which are saved snapshots of your data at a moment in time. For OneDrive and SharePoint, Microsoft keeps one every 10 minutes for the last two weeks, then weekly snapshots back to 52 weeks. For mailboxes it keeps 10-minute restore points for the full 52 weeks.
You choose how far back the backups reach: 3 months, 6 months, 1 year or 2 years. A policy that has not been changed reaches back 1 year.
For mailboxes, Microsoft also says the backup copies, once made, cannot be changed by the service. That is the property you want when ransomware is the worry.
What it costs
The list price is US$0.15 per GB of protected content per month, paid as you go. That is Microsoft’s price on its Microsoft 365 Backup pricing page, last updated 18 August 2026, and it is in US dollars because that is how Microsoft prices it. We checked it on 3 October 2026. Microsoft takes the payment through Azure, its cloud platform, and its pricing page says there are no extra Azure costs beyond the backup charge itself.
The number of GB is bigger than the size of your files, because Microsoft counts more than what your staff see. On top of the live size of each site and OneDrive, which already includes the first recycle bin, its pricing page counts:
- deleted files in the second-stage recycle bin of each SharePoint site and OneDrive (where deleted files go after someone empties the first recycle bin; Microsoft also calls it the site collection recycle bin)
- deleted and older versions of items in each protected mailbox
Microsoft’s own worked example: a 1 GB site with 0.5 GB in its second-stage recycle bin, plus a 1 GB mailbox with a 1 GB online archive (an extra mailbox for older mail), is charged as 3.5 GB. So a mailbox’s online archive is counted too.
For a feel of the bill at list price: if everything you protect comes to 200 GB once those extras are counted, that is US$30 a month. Microsoft measures the live part from your sites’ usage reports, so you can look up your own sizes there first.
What it restores, and what changed in 2026
For OneDrive and SharePoint, a full restore puts back a whole account or a whole site; the newer option for single files and folders comes below. For mail, you can restore a whole mailbox, or single items you find by search, into the same folder or a new folder in that mailbox. A full OneDrive restore puts the whole account back to the chosen moment, and Microsoft says it overwrites all content and metadata (the file details, such as names and dates) when it does. For OneDrive and SharePoint you can restore to the same address or a new one, which is the safer choice when you are not sure.
If you would rather see the admin screens than read about them, Microsoft’s own Mechanics channel walks through how the add-on works and how to set it up.
Watch on YouTube: How Microsoft 365 Backup works and how to set it up, by Microsoft Mechanics.
It shows the screens well, but it is the seller describing its own product. It was published in April 2025, before the two changes below.
Two changes this year make it easier for a small business to use:
- Single files and folders. An admin can now browse a restore point and bring back one file or one folder from SharePoint or OneDrive, instead of rolling back the whole site. Microsoft scheduled this for late March 2026 in its admin message centre (message MC1245216), and its Backup overview now lists a file and folder restore option.
- One policy for everything. Full Workload Backup lets an admin protect every SharePoint site, every OneDrive or every mailbox with one policy, and new ones are added on their own. Microsoft’s message MC1387526 said its general release would begin rolling out in mid-September 2026 and finish by mid-October 2026. Once it reaches your tenant it is there by default, but an admin has to set it up before it protects anything.
Even the paid add-on works per site, per OneDrive and per mailbox. It covers your content. It does not list your admin settings.
Your admin settings need their own record
Your tenant is more than mail and files. It is also every choice your admin has made: who can sign in and from where, which mail gets forwarded or blocked, who holds which licence, and who else is an admin.
Microsoft’s overview of Microsoft 365 Backup names SharePoint sites, OneDrive accounts and Exchange mailboxes. It names none of those settings. Treat them as yours to record.
Microsoft does have a separate tool for part of this, called Microsoft Entra Backup and Recovery. Entra is the part of Microsoft 365 that handles sign-ins and user accounts. This tool takes a backup once a day and keeps seven days of them. It covers users, groups, apps, Conditional Access policies (the rules that decide who can sign in, from where and on what device), named locations and sign-in method policies.
Two limits matter for a small business. It needs Microsoft Entra ID P1 or P2 licences, which are the paid levels of Entra and come with some plans. Its history reaches back only seven days.
Mail flow rules, which forward, block or label mail as it moves, are not named on the page for either tool. Neither is who holds which licence. Write those down yourself.
The minimum plan for a business of 5 to 50 people
The Cyber Security Agency of Singapore (CSA) lists five categories of measures in its Cyber Essentials mark, a certification for organisations, and backup is one of the five. Here is the smallest plan we would be comfortable with for a small office.
- List what you could not work without. Start with every mailbox, the shared SharePoint sites, and the OneDrive of anyone who keeps client work there. Name the people, not just the folders.
- Choose where the second copy lives. Microsoft 365 Backup is one choice, priced above. A backup tool from another company is the other. CSA’s advice on website attacks says backup data should be stored offline and not connected to your systems, and the same thinking applies here: the copy should not fall with the account it protects.
- Set how often. Microsoft’s add-on decides this for you, with restore points every 10 minutes for recent data. With any other method, our suggestion is at least once a day for mail and shared files. Ask yourself how many hours of work you could afford to redo.
- Write down your settings. One document: who your admins are, your sign-in rules, your mail flow rules, and who holds which licence. Update it whenever one of them changes. Keep a copy somewhere other than Microsoft 365.
- Test a restore. Pick one mailbox folder and one SharePoint file. Restore them to a new location, so nothing live is overwritten. Note how long it took and who did it. Our suggestion is twice a year, and again after any big change to your setup.
The test is the easiest step to put off. It is also the only one that tells you the other four worked. Until you have restored something from your backup, you do not know that you can.
If you are comparing with Google Workspace
Google Workspace has a tool that sounds like the answer, called Google Vault. Vault keeps and searches your company’s data for legal purposes. On the Business plans it comes with Business Plus only, as our Google Workspace security checklist sets out.
Google says plainly that Vault is not a backup. Its own Vault FAQ answers the question “Is Vault a data backup or archive tool?” with “No.” It gives the reasons: Vault exports cover a limited number of accounts and one Google service at a time, and you cannot schedule them to run on their own.
So the gap looks much the same on both sides. Microsoft’s built-in tools recover small mistakes, Google’s Vault keeps records, and on both sides the backup is something you plan for yourself. The five steps above work for a Google office too, with the backup tool you choose for Google in place of Microsoft’s.
If you are still choosing between the two suites, our Google Workspace vs Microsoft 365 guide compares them for a Singapore business.
What to read next
Two of the tools in this guide depend on your plan. Microsoft Entra Backup and Recovery needs Entra ID P1 or P2, and Business Premium includes P1. The archive mailbox is also much bigger on Premium, and Microsoft’s backup charges for what sits in it.
Our guide to Microsoft 365 Business Basic, Standard or Premium sets out what each plan carries, so you can see which of these tools you already pay for before you add anything.