In short
Microsoft 365 backup and restore means getting data back after deletion, overwriting, ransomware or admin error. Microsoft's recycle bins, version history and soft-delete windows handle recent, small losses, but each has a time limit of 14 to 93 days. A backup adds older restore points, granular and point-in-time restores, and copies held outside your tenant.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What a restore needs to do
A useful restore is more than "get the file back". In a real incident you usually need to answer four questions at once:
- What point in time? The last good version before the deletion, the overwrite or the first encrypted file
- How much? One email, one folder, a whole OneDrive, a SharePoint site or hundreds of accounts
- Where to? Back to the original location (in place) or to a separate folder, mailbox or site so nothing current is overwritten
- Who can do it? A help desk technician, a site owner, or only a Global or SharePoint Administrator
Microsoft 365's built-in tools answer these questions well for recent, small mistakes. They are less suited to old data, large volumes, or incidents where the admin accounts themselves cannot be trusted. That is the gap a backup closes, and it is why the Microsoft 365 shared responsibility model leaves recovering your data with you. Our Microsoft 365 recycle bin page lists every native safety net and its limit.
Seven scenarios, native route vs backup
This table summarises the common cases. Time limits are Microsoft's published defaults and some can be changed by an administrator.
| Scenario | Native route and its limit | Restore from backup |
|---|---|---|
| Accidental deletion of files or email | Recycle bins (93 days in total for SharePoint and OneDrive); Exchange recoverable items (14 days by default, up to 30) | Item-level restore from any retained restore point, to the original or a different location |
| Leaver's account deleted | Restore the user within 30 days; deleted user's OneDrive kept 30 days by default, then 93 days restorable by PowerShell | Restore mail and files from the leaver's backup, often kept after the seat is released (depends on the product) |
| Overwritten or corrupted files | Version history; OneDrive and SharePoint library restore to a point in the last 30 days | Point-in-time restore of a file, folder or library, beyond 30 days |
| Mass deletion by a compromised account | Recycle bins and library restore, if the attacker did not empty them | Restore at scale from copies the attacker could not reach |
| Ransomware encrypting synced files | OneDrive and library restore (30 days); Microsoft 365 Backup if it was set up before the attack | Roll back accounts or sites to the last clean restore point |
| Bad sync or migration | Version history, one file at a time, or library restore | Restore a folder or library to an alternate location and compare |
| Admin error (wrong retention policy, deleted site or team) | Deleted sites 93 days; deleted Microsoft 365 group or team 30 days | Restore the content even after the native window has closed |
The detailed how-to guides cover three of the most common requests: restore a deleted mailbox, restore a deleted SharePoint site and restore a deleted OneDrive. For incidents involving an attacker, see Microsoft 365 ransomware recovery.
Not sure which level fits? Ask us
Tell us what you need and we will help you choose the right level.
Restore options explained
Backup products describe restores in a few standard ways. It helps to know what each means before you compare them:
- Granular (item-level) restore: bring back a single email, calendar item, contact, file or list item without touching anything else
- Point-in-time restore: choose the date and time to restore from, so you can go back to before a problem started
- In-place restore: put the data back where it came from, usually overwriting or merging with what is there now
- Alternate-location restore: restore into a different folder, mailbox, OneDrive or site so current data is left alone while you check the result
- Non-destructive restore: a restore that does not overwrite newer data; Axcient describes x360Cloud restores this way
- Export: download data, for example a mailbox or folder as a PST file, for a legal request or to hand to a leaver's manager
Microsoft 365 Backup, Microsoft's own service, restores whole OneDrive accounts and SharePoint sites to an earlier point (to the same or a new URL) and restores Exchange mailboxes in full or item by item, to the same or a new folder. Our Microsoft 365 Backup Storage page explains the service in detail.
How the platforms we supply handle restores
Each of the five platforms we supply restores Exchange Online, OneDrive, SharePoint and Teams data, but they emphasise different things. In the vendors' own descriptions:
| Platform | Restore features the vendor highlights |
|---|---|
| Acronis | Search by sender, recipient, subject or date; item-level restore to the original or another mailbox or user; Teams channel conversations can be downloaded as HTML but not restored into Teams |
| Axcient x360Cloud | SmartSearch full-text search; non-destructive, point-in-time and granular restore; export in the browser, including PST |
| NinjaOne SaaS Backup | Point-in-time and item-level restore, with several incremental backups a day and an audit log |
| Redstor | InstantData streams the files and mailboxes people need first while the full restore continues in the background |
| Commvault | Granular, point-in-time restores in place or to a different location, from copies held outside Microsoft 365; PST and CAB export; self-service restore for Exchange and OneDrive in its Enterprise editions |
The Microsoft 365 backup comparison sets these side by side with retention, storage and licensing, and the workload guides show which data each product covers. Teams is where products differ most: see Microsoft Teams backup.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Teams and Entra ID restores
Two parts of Microsoft 365 behave differently from mail and files, and they are where restores most often disappoint.
Microsoft Teams. A team's files live in its SharePoint site, chat files in OneDrive and messages in Exchange-based storage. Microsoft says you cannot directly restore a deleted team: you restore its Microsoft 365 group, which is kept in a soft-deleted state for 30 days. After that, the SharePoint content may still be recoverable from Deleted sites for the rest of its 93 days, but the team itself is gone. Microsoft 365 Backup does not cover Teams chats, and third-party products differ: Acronis, for example, says private one-to-one and group chats are not backed up and channel conversations can be downloaded but not restored into Teams. Check what your product can put back, not just what it copies.
Microsoft Entra ID. Soft-deleted users, Microsoft 365 groups, cloud security groups, app registrations and service principals can be restored for 30 days. Microsoft Entra Backup and Recovery, for tenants with Entra ID P1 or P2, keeps up to seven days of daily backups of supported objects such as Conditional Access policies, but it does not re-create hard-deleted objects. A longer, independent history needs a product with Entra ID coverage; see Entra ID backup for the options we supply.
Test restores before you need them
A backup nobody has restored from is an assumption. The Microsoft 365 backup best practices checklist includes regular test restores, and we suggest testing at least these cases:
- Restore a single email and a single file to an alternate location, and check that folders, attachments and metadata come back as expected
- Restore a whole OneDrive or a SharePoint library to a point in time and compare it with the live copy
- Restore a leaver's mailbox after their account has been removed, to prove the product keeps what you think it keeps
- Check who in your organisation can start a restore, and that their sign-in to the backup console uses MFA
- Write down what you did and how long each step took, so your recovery plan reflects real experience rather than a vendor brochure
Restore times depend on data volume, the product and Microsoft's own service limits, so we do not quote them; a test restore tells you far more.
How we help
We start with the restores you most need to be able to do, then match a platform to them rather than the other way round. We can review your current recycle bin, retention and backup settings, recommend one of the five platforms (or explain where Microsoft 365 Backup fits), connect it to your tenant, agree retention and who can restore, and run a test restore with you before handover. Licences and renewals sit on one Forever Systems account, and pricing is confirmed at quote; the Microsoft 365 backup pricing page explains how each option is charged.
Contact us to talk through the restores you need to be able to do.
Step-by-step restore guides
How Forever Systems helps with Microsoft 365 backup
We are an independent UK IT and cyber security provider. We supply more than one Microsoft 365 backup product, so we can recommend what fits your tenant, your retention needs and your budget rather than one vendor's answer to everything.
- Review what you have: we look at your Microsoft 365 licences, retention policies and any existing backup before suggesting anything new
- Help you choose: we compare the backup products we supply against the workloads you need covered, such as Exchange Online, OneDrive, SharePoint, Teams and Entra ID
- Set-up and onboarding: we can help connect the backup service to your tenant and agree what is protected and how long copies are kept
- Restore testing: we can help you plan and run test restores so you know how recovery works before you need it
- Licensing in one place: backup licences alongside your Microsoft 365 subscriptions, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Contact us to talk it through.
Frequently asked questions
Can you restore deleted emails in Microsoft 365?
Yes, within limits. Deleted mail moves to recoverable items, kept for 14 days by default in Exchange Online, and an admin can extend this to 30 days. After that, or after a mailbox is permanently deleted, you need a retention policy, a hold or a backup to get it back.
How far back can Microsoft 365 restore files?
SharePoint and OneDrive recycle bins keep deleted items for 93 days in total, and the OneDrive and library restore features roll back changes from the last 30 days. Older data can only come from version history, a retention policy, Microsoft 365 Backup or a third-party backup.
What is a granular restore?
A granular, or item-level, restore brings back a single item, such as one email, one calendar entry or one file, without restoring the whole mailbox or site. It is the most common type of restore and saves overwriting data that is still correct.
Does a restore overwrite current data?
It depends on the option chosen. In-place restores put data back where it came from and can overwrite newer changes, while alternate-location and non-destructive restores leave current data alone. Microsoft 365 Backup's site and OneDrive rollback can restore to a new URL to avoid overwriting.
Who can restore data in Microsoft 365?
Users can restore their own files from the recycle bin and their own OneDrive. Library restores need a site admin, deleted sites and old OneDrive accounts need a SharePoint Administrator, and restoring deleted users needs a suitable admin role. Backup products have their own restore roles, which should be kept to as few people as possible.
Still have a question about Microsoft 365 backup and restore?
Ask us and a member of our team will reply by email.