The bottom line
Microsoft 365 keeps deleted items for a short time: 14 days for email by default, 93 days for files in OneDrive, and 30 days for a deleted user. That saves you from an accidental deletion you notice quickly. It does not save you from something you discover two months later, from a user deleted without preparation, or from a whole folder deleted with one click.
What Microsoft 365 does keep
Email. A deleted email first goes to the Deleted Items folder. When that is emptied, the email moves to a hidden area called Recoverable Items, and is kept there for 14 days by default. The administrator can extend that up to 30 days, no more. After that the email is deleted.
Files in OneDrive. In a work account, a deleted file stays in the recycle bin for 93 days, unless the administrator changed the setting. In addition, the entire OneDrive can be rolled back to a point in time within the last 30 days. That is the tool that helps after all the files were encrypted or deleted at once.
Version history. If someone saved over a file, you can go back to a previous version of it.
What happens when an employee leaves
This is where most small businesses lose data, because the user is deleted to save a license.
- There are 30 days to restore a deleted user. After that their email is permanently deleted.
- The email has to be moved before the deletion. Microsoft itself writes that if you want to keep the email, you need to move it before deleting the account. The common way: convert the mailbox to a shared mailbox, which needs no license.
- Their OneDrive is kept for 30 days by default, then another 93 days in a recycle bin from which only an administrator can restore, and only with PowerShell.
- Files the employee synced to a personal computer stay with them. There is no way to delete them remotely.
What it does not cover
- A deletion discovered late. An email deleted two months ago will not come back, even if you set the maximum.
- A folder deleted in email. According to the documentation, a folder the user created and deleted with Shift+Delete does not come back as a folder. Only its contents remain recoverable, and only within the 14-day window.
- The whole account. If access to the account is lost, or the subscription is cancelled, there is no copy outside the account.
What a small business should do
- Decide what must not be lost. Usually: the email of the owner and of the bookkeeping, and the business's shared folder.
- An external backup of 365 for what must not be lost: a copy outside the account, for as long as you decide.
- A written offboarding procedure: first a shared mailbox and a file handover, and only then delete the user.
- A regular restore test. A backup you have never restored from is an assumption, not a backup.
Backup and restore tests are part of cloud backup for businesses, and the offboarding procedure is part of IT support for businesses.