What Microsoft protects, what it leaves to you, and how to choose the right recovery plan for each site. Updated November 2026.
Short answer: Microsoft keeps SharePoint Online running and keeps replicated copies of your data so the service survives hardware or datacenter failures. That is resiliency, not a backup you control. In Microsoft’s own words, a disaster recovery copy “maintains the current state of content, not any historical versions from prior points in time” (Microsoft 365 Backup FAQ). If a user, a rogue admin or ransomware damages your files, the replicated copy faithfully holds the damaged version too. That is also true for content shared outside the company, which is why secure external sharing matters as much as backup.
SharePoint does include useful recovery tools, and Microsoft now sells a native backup product. The real question for most organizations is which sites need more than the built-in tools, and how quickly each one must come back.
What Microsoft protects and what you protect
Microsoft describes its approach to service resiliency, including replication across datacenters, in its data resiliency overview. Those controls protect Microsoft’s platform. They do not decide who in your tenant can delete a library, how long deleted content should be recoverable, or whether a restore has ever been tested. Those are your decisions.
Figure 1. Microsoft runs the service. Your organization owns recovery from damage inside the tenant.
Built-in recovery: what you get without buying anything
Every SharePoint Online site includes four recovery layers. Each one has a clear limit, and those limits are where most data-loss surprises come from.
1. Version history
Libraries keep earlier versions of files, so a user can roll back a bad edit. Admins can set version limits at tenant, site or library level, including automatic limits that trim older versions over time (version history limits). Versions protect against bad edits, not against deletion of the file or the whole library. Versions also count toward site storage, so set limits with your SharePoint storage quotas in mind.
2. Two-stage recycle bin
Deleted items go to the site recycle bin and then to the site collection recycle bin. Microsoft retains them for 93 days from the original deletion, and the clock does not reset when an item moves to the second stage (Microsoft Support). After that, the content is permanently deleted.
3. Files Restore
Site owners can roll an entire document library back to an earlier point using Settings, then Restore this library. It undoes file and folder activity from the last 30 days and is built for mass deletion, overwrites and malware encryption (Restore a shared library).
4. Deleted site restore
Deleted sites stay recoverable in the SharePoint admin center for 93 days. If the site belongs to a Microsoft 365 group, the other group resources are kept for only 30 days (restore deleted sites).
Figure 2. Built-in recovery windows compared with Microsoft 365 Backup.
Retention policies are not a backup
Microsoft Purview retention policies keep copies of content for compliance and legal reasons, even if users delete it. That is valuable, but it is designed for holding and finding content, not for putting a damaged site back the way it was. Microsoft makes the same point about legal holds: they are “optimized for export (for example, via eDiscovery), not for mass restore” (Backup FAQ). Use retention for compliance and a backup for recovery.
Microsoft 365 Backup: the native option
Microsoft 365 Backup is a separate, paid service that protects selected SharePoint sites, OneDrive accounts and Exchange mailboxes. Data stays inside the Microsoft 365 trust boundary (overview). Key facts from Microsoft’s current documentation:
Price: $0.15 per GiB per month of protected content, billed pay-as-you-go through an Azure subscription. Restores are free (pricing).
Recovery points: every 10 minutes for the last two weeks, then weekly through the recovery window you configure, up to 10 years (FAQ).
Granular restores: individual files and folders can only be restored from points in the last 14 days. Older points support full-site restore only.
Speed: Microsoft quotes median rates of up to 1 to 3 TiB per hour across up to 1,000 average-sized sites, with in-place restores the fastest (overview).
Billing nuance: deleted content still counts toward the bill until it ages out of the recovery window, so storage cost does not drop the moment you clean up a site (pricing).
Setup requires a Global or SharePoint admin to connect billing and create protection policies (setup guide). Third-party backup tools remain a valid choice when you need copies outside Microsoft’s infrastructure, longer granular file restores, or one product across several clouds.
Option | Best for | Main limit | Cost |
Version history | Bad edits to single files | Does not cover deletions | Included |
Recycle bins | Accidental deletes | 93 days from deletion | Included |
Files Restore | Mass delete or encryption in one library | Last 30 days, one library at a time | Included |
Purview retention | Compliance and eDiscovery | Not built for bulk restore | Included in eligible licenses |
Microsoft 365 Backup | Fast bulk site restores, long windows | File-level restore only in last 14 days | $0.15 per GiB per month |
Third-party backup | Off-platform copies, multi-cloud | Restore speed and features vary by vendor | Per user or per TB |
Table 1. SharePoint Online recovery options compared. Sources: Microsoft Learn and Microsoft Support links above.
Plan around RPO and RTO, not features
Two numbers drive the decision. Recovery point objective (RPO) is how much recent work you can afford to lose. Recovery time objective (RTO) is how long the business can wait for the site to come back. A finance site at month-end and a team’s old project archive have very different answers, so they should not get the same protection.
Figure 3. A quick test to decide whether a site needs backup.
Most organizations end up with three tiers. Protecting only the sites that matter keeps backup cost tied to real business risk.
Figure 4. A simple tier model for SharePoint backup and restore testing.
Where built-in recovery usually falls short
Ransomware across many sites. Files Restore works one library at a time. Rolling back dozens of sites by hand during an incident is slow and error-prone.
Late discovery. Someone notices a deleted folder four months later. The 93-day recycle bin window has already closed.
Departing staff. A leaver’s OneDrive and the team sites they owned are cleaned up on schedule, and nobody checked what was still needed. Clear rules on where files should live prevent most of this.
Admin mistakes or malicious insiders. An account with high privileges can empty recycle bins. A separate backup with its own admin roles reduces that single point of failure. Pair it with strong admin sign-in controls, as covered in our Storm-0558 Entra hardening guide and cybersecurity services.
Test the restore before you need it
A backup is not proven until someone has restored from it. A simple test plan answers four questions:
Who is allowed to start a restore, and who approves it?
Which restore point would you pick, and how do you find it?
Does the restore go to the original site or a new URL for checking first?
Who on the business side confirms the restored content is complete?
Record the time each test takes. That measured number, not a vendor estimate, is your real RTO. When restores fail in testing, the cause is often permissions or site structure, which our SharePoint troubleshooting guide and permissions guide cover in more detail.
The MSPowerhouse perspective
We see the same pattern in most tenants we review: good built-in features, no written recovery plan, and nobody sure who can restore what. Our approach is practical. We tier your sites, set recovery targets with the business owners, configure backup and recovery for the sites that need it, and run monthly or contract-based restore tests with a short report. As part of managed IT support, our engineers monitor backup status, device health and license expiry, and share a weekly report.
If you also need help cleaning up site structure or permissions first, our SharePoint services team handles that alongside the backup work, using the approach in our information architecture guide. Planning a move from file servers? Add backup to your migration checklist from day one. See all our IT services.
Not sure if your SharePoint data is recoverable? Book a free IT consultation or start with our free IT assessment. We will show you which sites are exposed and what it would cost to protect them.
Sources
Restore deleted SharePoint sites
Restore items in the SharePoint recycle bin
