Microsoft 365 Backup: Does It Cover Email?

Does Microsoft 365 back up your email? A Microsoft 365 backup is not on by default, and it is not what most owners mean when they say backup.

Microsoft keeps the Exchange Online service running. That is not a copy of your mailbox that you can roll back to last Tuesday. The recycle bin, the Recoverable Items folder, a retention policy, and Microsoft 365 Backup are four different tools. They answer four different questions. Mixing them up is how a company finds out, on the day it matters, that “we are in the cloud” was not a restore plan.

A Los Angeles firm can have a clean Microsoft 365 bill and still have no point-in-time copy of email. The invoice proves you are a customer. It does not prove anyone turned on a backup policy.

A Microsoft 365 backup policy is the only one of those tools that is built to put a mailbox back. The others keep, hide, or expire the mail.

What is Deleted Items?

Deleted Items is the folder people can see. You delete a message from the inbox, and Outlook moves it there. That is an undo, not a backup. Anyone with the mailbox can empty it. A shared mailbox that three people use is three people who can empty it.

Microsoft’s own terms are plain. A delete puts the item in the Deleted Items folder. A soft delete, including Shift+Delete, moves it out of sight and into Recoverable Items. A hard delete marks it to be purged from the mailbox database.

So the folder named Deleted Items is the first stop. It is not the last copy.

What is the Recoverable Items folder?

Recoverable Items is the hidden folder Exchange Online uses after a soft delete. Users do not see it in Outlook. It is where deleted-item retention, single-item recovery, holds, and retention policies do their work.

Items sit in the Deletions area of that folder until the deleted-item retention period ends. Microsoft’s Exchange Online documentation says the default period is 14 days. An admin can raise it, up to 30 days. When that period ends, Exchange removes the item, unless something else is holding it.

There is a sharp edge in the same document. If someone Shift+Deletes a folder in the mailbox, or deletes a folder that is already inside Deleted Items, the folder itself is hard deleted. Microsoft says that folder cannot be recovered even if the mailbox is on litigation hold or in-place hold. The messages inside move to Recoverable Items, where the retention clock still applies. The folder structure does not come back. A backup is what you want if the shape of the mailbox matters, not just a pile of recovered messages.

Recoverable Items also has its own quota. A mailbox that is dumping mail into that folder all year can hit the quota. That is a storage limit, not a restore plan.

What do retention policies and holds keep?

A retention policy tells Microsoft 365 how long to keep certain information, and sometimes when to delete it. A litigation hold, an eDiscovery hold, or a preservation hold tells Exchange to keep items so they can be found later. Those features use the Recoverable Items folder. They exist so a company can preserve and search. They are not a button labeled “put the inbox back the way it was on March 3.”

That distinction is the whole article. Retain means the information may still exist somewhere an admin or a legal hold can reach. Restore means a person can put a mailbox, a folder, or a message back into working use without a discovery project.

Holds are also easy to misunderstand in the other direction. A hold can keep data the business no longer wants in an active mailbox. That can be the right outcome for a legal matter. It is a bad surprise if the owner thought “retention” meant “we can undelete anything, quickly, for as long as we like.”

If a mailbox is on hold, ask who set the hold, why, and how a restore would actually be done. “We have retention” is not an answer until someone can show the policy and a recent restore.

Is Microsoft’s service availability the same as a backup?

No. Microsoft runs Exchange Online so a failed disk in their datacenter is their problem, not yours. That protects the service. It does not give you a private copy you control, and it does not undo a person who deleted the wrong mailbox. Their uptime is not your restore.

What is Microsoft 365 Backup?

Microsoft 365 Backup is a separate product. Microsoft’s overview, dated August 18, 2026, describes backup and restore for Exchange mailboxes, SharePoint sites, and OneDrive accounts. You choose what to protect with a backup policy. It is not the recycle bin with a longer name.

For Exchange, that document says recovery points are every 10 minutes for the prior 52 weeks, and the recovery window on a policy can be set to 3 months, 6 months, 1 year, or 2 years. Existing policies default to 1 year. A mailbox restore can put modified or deleted items back, into the same mailbox or a new folder. It does not, in that description, wipe the whole mailbox back to an older day the way a full SharePoint site rollback does. Read that twice before you promise a client “the whole mailbox rolls back.”

SharePoint and OneDrive restores in the same document can roll a site or account back to an earlier point, which overwrites what changed after that point. File-level version restore was still marked “coming soon” on that page. Do not tell an owner that part is live until the page says it is.

Microsoft 365 Backup is also available through partner applications built on the same storage platform. A third-party backup can be the independent copy. The question is not the logo on the tool. The question is whether a policy is on, what it covers, how far back it goes, and whether anyone has restored from it.

Paying for Microsoft 365 email does not, by itself, prove that Microsoft 365 Backup is turned on. Check the tenant before you assume it is included. This draft does not state a price.

What happens after an accidental deletion?

It depends which door the message went through, and how long ago.

If it is still in Deleted Items, the person restores it. That is the easy case.

If it was emptied or Shift+Deleted, and it is still inside the 14-day window, or whatever window the admin set up to 30 days, an admin can often recover it from Recoverable Items. That is a real feature. It is also a timer.

If the timer has expired and nothing is holding the item, Microsoft’s document says the item is removed from Exchange Online. At that point the recycle bin cannot help. A backup policy can, if one was running before the delete and the recovery window still covers that day.

If the whole mailbox was deleted, Microsoft’s mailbox article describes a soft-deleted mailbox as one that is still in the Microsoft Entra recycle bin and has been there for less than 30 days. After that, the normal path is a permanent purge. A litigation hold or eDiscovery hold that was already on the mailbox can change that path. Do not assume a deleted user is recoverable next quarter because “Microsoft keeps everything.”

What happens after a compromise or a malicious delete?

An attacker with a mailbox, or with an admin role, does not use the recycle bin politely. They delete, they purge, they set rules, and they do it across more than one mailbox if they can.

The 14-day Recoverable Items window is a poor answer to that. It is short, it is inside the same tenant the attacker may already control, and it was not designed as an off-to-the-side copy. A hold keeps data for search. It does not, by itself, give you a clean mailbox from the hour before the rules were created.

A backup that the attacker cannot delete is the difference. Microsoft’s backup overview names ransomware and malicious deletion as reasons the product exists, and it talks about restore speed because copying a huge tenant back from a remote copy can take weeks. Speed is part of the product choice. So is separation. Ask where the backup lives, who can delete the backup policy, and whether that admin is the same account that can empty the mailboxes.

None of this makes any product completely secure. A backup you have never restored is a brochure.

What should a business ask about its current Microsoft 365 protection?

Ask these in one sitting. If the answers are “I think so,” you do not have a plan yet.

• Is there a backup policy for Exchange, or only Deleted Items and the default 14-day window?
• Who can change that policy, and who can delete it?
• How far back can you restore one message, one folder, and one mailbox?
• When was the last restore test, and what did it prove?
• Is any mailbox on litigation hold or a retention policy, and is that hold a substitute for backup in someone’s head?
• What happens if an admin account is compromised and starts purging mail?
• Are SharePoint and OneDrive in the same policy, or is email the only thing anyone checked?
• If a user is deleted, how many days do you have, and who is allowed to restore the mailbox?

Write the answers down. A screenshot of the backup policy beats a sentence in a proposal.

What to verify before you call it a Microsoft 365 backup

Do not treat a license as a restore plan. Ask whether a Microsoft 365 backup policy is on, who can delete that policy, and when anyone last restored a mailbox. If those answers are guesses, the backup is not in place.

A short way to sort the tools

• Deleted Items: visible undo. The user can empty it.
• Recoverable Items: hidden, 14 days by default, 30 days max, unless a hold or retention rule keeps the item.
• Retention or a hold: keeps information for a rule or a legal matter. Not a friendly rollback.
• Microsoft 365 Backup, or another backup product: a policy, a recovery window, and a restore you can test.
• Service uptime: Microsoft’s job. Not your Tuesday.

FAQ

Does Microsoft 365 include a backup of email?

Exchange Online includes deleted-item recovery for a limited period. Microsoft 365 Backup is a separate product you configure. Do not treat the license as proof that a backup policy is on.

How long does Microsoft keep deleted email?

The default deleted-item retention period in Exchange Online is 14 days. An admin can extend that period up to 30 days. A hold or retention policy can keep items longer. Those longer copies are not the same thing as a point-in-time restore.

Can I get a deleted mailbox back?

Often, if it is still a soft-deleted mailbox and fewer than 30 days have passed, or if a hold was already in place. After the normal window, assume it is gone unless someone can show a hold or a backup that covers that day.

Is a retention policy enough for ransomware?

No. Retention helps you keep and find information. A backup you can restore, and that the same compromised admin cannot simply delete, is the tool for getting the business back to work.

More on the restore side of this lives on the data backup and disaster recovery page. The handoff is also where backup tests get skipped: how to switch IT support providers. A restore belongs in the incident response plan, or it stays a wish. Related reading sits on the STG blog. This draft will not appear there until someone publishes it.

Microsoft’s own pages, opened September 30, 2026: Recoverable Items folder, Microsoft 365 Backup overview, and delete or restore mailboxes.

If you cannot say whether a backup policy is on, ask for a look at the tenant before you need a restore. Book a conversation.

Contact Us