Outside copies: Backup copies of your email, OneDrive files and SharePoint sites are kept outside your Microsoft 365 account, so a problem inside the account cannot reach them.
Beyond the recycle bin: Microsoft keeps deleted mail for 14 days by default and recycle bin files for 93 days. The outside copy is not bound by those windows.
Separate from attacks: Ransomware that syncs into OneDrive, or a compromised admin who deletes mailboxes, works inside your tenant. The outside copy sits under different accounts.
Managed by CinchOps: CinchOps sets up the backup and runs it day to day, so nobody on your team has to remember to check it.
Restore path: When something is deleted, encrypted or overwritten, data comes back from the outside copy instead of depending on what the recycle bin still holds.
A recycle bin inside the same account is not a backup.
BOOK A FREE CONSULTATION
Ask who backs up Microsoft 365 and most owners say Microsoft. Under Microsoft's shared responsibility model, Microsoft keeps the service online. Protecting the email, files and sites inside it falls to you.
CinchOps keeps backup copies outside your Microsoft 365 account, out of reach of anything that goes wrong inside it.
CinchOps keeps a copy of your Microsoft 365 data where a problem inside Microsoft 365 cannot reach it.
Microsoft's retention windows are short and live inside the same account an attacker or a mistake can reach.
Uptime and the platform itself are Microsoft's responsibility.
Under Microsoft's model, protecting the data is the customer's job.
Deleted mail and files are recoverable only for set periods.
Ransomware and compromised admins act inside the same account as the recycle bin.
CinchOps keeps backup copies outside your Microsoft 365 account.
When something goes wrong inside, the outside copy is still there.
The numbers above are the defaults. These are the edge cases that catch businesses out, all taken from Microsoft's own documentation.
Exchange Online keeps deleted mail recoverable for 14 days by default. An admin can raise that to 30 days, and no further. After that, the item is gone.
When someone hard-deletes a folder they created in their mailbox, the folder itself cannot be recovered, even under a legal hold. Its messages survive for the retention period, loose, with the filing structure gone.
When an employee's account is deleted, their OneDrive is kept for 30 days by default, then moved to a recycle bin for 93 days. Getting it back from there takes PowerShell, not a click.
A OneDrive with no valid license is archived automatically on its 93rd unlicensed day. After 12 months in that archive, Microsoft says the data might be deleted regardless of retention settings or holds.
Microsoft notes that the recycle bin is not indexed, so searches and eDiscovery holds cannot find content sitting in it. It can be browsed by hand, but a search across the business will not surface it.
Retention policies and labels override the standard OneDrive deletion process, so a policy set up for another reason can delete content before the 30 days are up.
Microsoft 365 Backup is a separate, paid product, and for some organizations it is a reasonable choice. The difference that matters for this page is where the copies live.
It backs up Exchange mailboxes, OneDrive accounts and SharePoint sites, either all of them or a selected set.
Each backup policy keeps restore points for 3 months, 6 months, 1 year or 2 years. Existing policies default to 1 year.
It costs $0.15 per GB per month for all protected data, billed pay-as-you-go rather than per user. Restores are free.
Microsoft states that backup data never leaves the Microsoft 365 trust boundary. Copies are append-only, but the backup admin can still delete them, with a 90-day grace period to undo it. An outside copy sits under different accounts entirely.
It starts with a free consultation. From there, we check your current retention settings and what an outside copy would need to cover.
No. A hold stops items from being purged so they can be found in a search. It lives in the same mailbox, counts against a recoverable items quota of up to 100 GB, and is not a copy you can roll a mailbox back from.
Not always. A backup returns the data but does not undo the exposure. If sensitive personal information was taken first, Texas law can still require notice to affected people within 60 days, and to the Attorney General within 30 days when 250 or more Texans are affected.
Ask for a restore, not a report. A test restore of one mailbox and one site, done on a schedule, is the only proof that the copy is complete and that someone knows how to bring it back.
No. This protects what lives in Microsoft 365. Servers, PCs and on-premises databases need their own backup, which is what Backup as a Service covers.
Keep a copy of Microsoft 365 outside Microsoft 365, with CinchOps.
Your whole IT environment run, monitored, and maintained.
24/7 threat monitoring, response, and employee protection.
Backups and recovery plans that keep you running through anything.
Microsoft 365 and cloud infrastructure done right.
Fast, reliable networks built for how you work.
Business phones that work anywhere, without the phone-company bill.
Audit-ready security and documentation for regulated work.
Backup and muscle for your in-house IT team.
Executive-level technology strategy tied to your business goals.
Repetitive work automated so your team does what earns.
Expert IT guidance when you need it, billed by the hour.
IT projects planned, executed, and delivered on time and on budget.
Tell us where to reach you and we’ll take it from there.
Even after the window closes.
The copy lives outside.
Not lost when the account goes.
Someone owns the backup.
Book A Consultation for a Free Managed IT Quote