People buy Microsoft 365 and assume their files are backed up. What they actually have is version history and a set of recycle bins, each with its own expiry clock. Those features recover a surprising amount, and then they stop, usually at the exact point someone needs them.
Here is what is genuinely recoverable, how long each thing survives by default, and where the gap sits.
Version history: what it does and does not do
SharePoint and OneDrive keep previous versions of a file automatically. Every save creates a version, and you can open or restore any of them from the file’s version history.
Two limits matter. Version history is held per file, so if the file itself is deleted, you are no longer dealing with versions, you are dealing with the recycle bin. And the number of versions retained is a library setting, which means it can be lowered by an administrator, including to a value that will not help you later.
Check the setting rather than assuming the default. It is per document library, so one site can be generous and another can be nearly empty.
The two stage recycle bin
Deleted files go to the site recycle bin, and when they are removed from there they move to a second stage bin that only administrators can see. The total retention across both stages is a fixed window measured in days, not months, and once it elapses the file is gone from the service.
This is the single most misunderstood part of Microsoft 365. The recycle bin is not an archive. It is a short grace period.
Email: deleted items, recoverable items, and what survives a leaver
Mail has its own layers. An item removed from Deleted Items moves into a recoverable items area that users can reach through recover deleted items, and after that window it is purged unless a hold or retention policy keeps it.
The sharper risk is licence removal. When a staff member leaves and the licence is reassigned, the mailbox is on a clock. If you need that mailbox later, for a dispute or a client history, the options are to keep it licensed, convert it to a shared mailbox, apply a hold, or export it before the licence goes.
Deciding that on the day someone resigns is how mailboxes get lost. It belongs in a written offboarding checklist.
What is recoverable, and what is not
| Situation | Recoverable through Microsoft 365? |
|---|---|
| Overwrote a document this morning | Yes, version history |
| Deleted a file last week | Yes, recycle bin |
| Deleted a file well beyond the retention window | No |
| Deleted an email last month | Usually, through recoverable items |
| Mailbox of someone who left and whose licence was removed | Only if you held, converted or exported it in time |
| Ransomware encrypted synced files | Sometimes, if versions were kept and not exhausted |
| Teams chat history beyond policy | Rarely, and not in the form people expect |
| A site deleted and purged by an administrator | No |
Where the real gap sits
Microsoft protects the platform. It does not protect you from yourself, from a departing employee clearing a folder, or from an attacker with an administrator session. Everything above has a clock on it, every clock is measured in days or weeks, and all of them can be shortened by configuration.
Two things close the gap. First, retention policies configured deliberately rather than left at defaults. Second, a third party backup of the tenant, with its own retention and its own credentials, so a compromised administrator account cannot remove your only copy.
What to check this week
- Open a document library’s version settings and note how many versions it keeps.
- Note your recycle bin retention and write the number of days somewhere visible.
- List mailboxes belonging to people who have left, and what is keeping them.
- Confirm whether anything backs up the tenant outside Microsoft, and who holds those credentials.
- Restore one file and one email as a test, and record how long it took.
Step 5 is the one that tells you whether the first four are configured the way you think.
We configure retention, offboarding and tenant backup as part of Microsoft 365 management, with protection beyond the platform under cloud backup and recovery. Running Google instead? See Google Workspace management.