Microsoft Shared Responsibility Model

Who is responsible for protecting your data in Microsoft 365?

What this means for your organization: Microsoft's native retention is not a backup, and it is shorter than most people expect. Deleted Exchange Online items are kept 14 days by default and 30 days at most; SharePoint and OneDrive recycle bins hold deleted items for 93 days in total across both stages. After that the data is gone. Microsoft recommends that customers keep their own backups, and its own first-party backup for Microsoft 365 is a separately-billed add-on rather than something included by default.