Is OneDrive a Backup? No, and Here’s How Long Microsoft Keeps Deleted Files

Lots of businesses assume Microsoft 365 or Google Workspace is “backed up” because files live in the cloud. In our YouTube video, Jason and Mabel walk through why sync isn’t backup, how long deleted files really stick around, and the three questions every business should ask whoever handles its IT.

Is OneDrive a backup?

No. OneDrive is a sync tool. It keeps the same files available on every device you sign in to. That’s useful, but it means a deleted file or a file encrypted by ransomware can sync everywhere too. A real backup is a separate, independent copy that someone checks and has tested restoring.

• Sync: one set of files, mirrored across devices. Mistakes mirror too.
• Version history and the recycle bin: helpful safety nets, but they run on a clock.
• Backup: an independent copy, kept for as long as your business needs, and tested.

How long does Microsoft 365 keep deleted files?

These are Microsoft and Google defaults. Admins and retention policies can change them.

A few details from Microsoft’s documentation worth knowing:

• The 93 days is one clock, not two. Files sit in the site recycle bin. If someone empties it, they move to the second-stage (site collection) recycle bin for the rest of the 93 days.
• It can end early. If the second-stage bin goes over its quota, the oldest items are purged, and an admin can delete them manually.
• Microsoft’s extra 14 days restores whole sites, not files. SharePoint keeps backups for 14 more days, but Microsoft Support can only restore an entire site collection from them.
• Departing employees: when a user is deleted, their OneDrive is kept 30 days by default, then moved to the recycle bin for 93 days, where an admin can restore it only with PowerShell.

Most people don’t notice a missing file for months. By then the recycle bin clock has often run out.

Does Microsoft 365 back up my data?

Microsoft keeps the service running and offers native recovery features. Protecting your data from deletion, mistakes, and attacks is still your responsibility. Microsoft’s shared responsibility guidance says that for every cloud type, you own your data and identities. Its consumer services agreement recommends regular backups. Microsoft also sells a separate, optional backup service.

The takeaway isn’t that Microsoft or Google have no recovery tools. It’s that your business has to decide what must be recoverable, and how far back.

How long do we need to keep email and files?

It depends on the records and your industry. Two examples from the video:

• HIPAA: certain Security Rule compliance documentation must be kept 6 years (45 CFR 164.316). HIPAA does not set a blanket medical-record retention period. That usually comes from state law.
• South Carolina physicians: keep records at least 10 years for adults and 13 years for minors, from the last treatment (SC Code 44-115-120).
• Other provider types, industries, and states have different rules. Work with your compliance or legal adviser on the schedule.

ADVYON helps align backup retention with the frameworks and requirements clients follow. Backup software alone doesn’t establish compliance, and this post is educational, not legal advice.

What makes a backup plan actually work?

• Follow 3-2-1: three copies total (including the original), on two types of storage, with one copy offsite (CISA).
• Protect the backups from the same attack that could hit your working files (see our ransomware checklist).
• Real people monitor results. A green check mark on a report doesn’t prove you can get a file back.
• Test restores on a regular, documented schedule. That follow-through is where we see most businesses drop off.

At ADVYON, we use more than one backup method for Microsoft 365 and Google Workspace, including automatic backups. Coverage depends on the configured plan. Real people on our team monitor backups and perform periodic test restores to check that data is actually recoverable. More on why it matters: the critical importance of backups for your business.

3 questions to ask your IT provider about backups

1. Who checks our backup results, and how often?
2. When was our last test restore, and what did we actually get back?
3. How long do we keep email and files, and does that match our industry’s rules?

If nobody can answer all three, that’s your answer.

Frequently asked questions

Is OneDrive a backup?

No. OneDrive is a sync tool. Deletions and ransomware-encrypted files can sync too. An independent, tested backup is a separate thing.

How long does OneDrive keep deleted files?

Work or school OneDrive and SharePoint keep deleted items 93 days from deletion, across both recycle bins, unless the second-stage bin hits its quota or an admin purges them. Personal OneDrive keeps them 30 days.

How long does Outlook keep deleted email in Microsoft 365?

Exchange Online keeps email for 14 days by default after it leaves Deleted Items. Admins can raise this to 30 days.

What happens to a OneDrive when an employee is deleted?

By default the OneDrive is kept 30 days (admins can change this), with access going to the user’s manager. It then sits in the recycle bin for 93 days, where an admin can restore it with PowerShell.

How long does Gmail keep deleted emails?

30 days in Trash. For Google Workspace accounts, an admin can restore for about 25 more days.

Does Microsoft 365 back up my data?

Microsoft keeps the service running and offers native recovery features plus a separate optional backup service. Protecting your data from deletion, mistakes, and attacks is still your responsibility.

Does HIPAA require seven years of medical records?

Not as a blanket rule. HIPAA requires certain compliance documentation to be kept 6 years. Medical-record retention usually comes from state law.

How often should backups be tested?

On a regular, documented schedule. Ask when the last test restore happened and what was actually recovered. To review yours, book a free Discovery Meeting at advyon.com/contact/ or call (843) 324-5824.

Want a second set of eyes on your backups?

ADVYON has helped Lowcountry businesses with technology since 2008, from Summerville and Mt Pleasant. Book a free Discovery Meeting and we’ll walk through all three questions with you. Call (843) 324-5824 or visit advyon.com/contact/. See our managed IT services and managed security services pages for how we work.

Sources

• ADVYON YouTube: Is OneDrive a Backup? No, and Here’s How Long Microsoft Keeps Deleted Files
• Microsoft Learn: Restore deleted items from the site collection recycle bin
• Microsoft Learn: OneDrive retention and deletion
• Microsoft Learn: Recoverable Items folder in Exchange Online
• Microsoft Learn: Shared responsibility in the cloud
• Microsoft Learn: Microsoft 365 Backup overview
• Microsoft: Services Agreement
• Google: Drive trash, Gmail trash, Admin restore
• eCFR: 45 CFR 164.316 · SC Code: 44-115-120
• CISA: Back up business data

Retention figures are Microsoft and Google defaults as of Nov 6, 2026 and can be changed by admins or retention policies. Educational information, not legal advice. The hosts in the video are AI-generated presenters.