Office 365 Deleted Email Retention: How Long Data Really Lasts

Q: How long does Office 365 keep permanently deleted emails?

After a message is removed from the Deleted Items folder, Exchange Online keeps it in the hidden Recoverable Items folder for 14 days by default, and an administrator can extend that to a maximum of 30 days. After that window it is permanently purged unless a retention policy or litigation hold applies. Third-party backup is the only way to keep deleted mail longer with reliable, fast restores.

Q: How long are deleted files kept in OneDrive and SharePoint?

Deleted OneDrive and SharePoint files pass through a first-stage recycle bin and a second-stage recycle bin, with a combined retention of 93 days from the original deletion. After that they are permanently removed. OneDrive also offers Files Restore, which can roll a whole library back to any point within the past 30 days, which is useful after ransomware or a mass deletion.

Q: What happens to email when a Microsoft 365 user is deleted?

The deleted account, its mailbox, and its OneDrive are retained for 30 days and can be fully restored during that period. After 30 days they are permanently deleted unless a hold or retention policy was applied first. Before removing a departing employee's account, convert the mailbox to a shared mailbox or apply a hold and transfer OneDrive ownership so nothing important is lost.

By default, Microsoft 365 keeps a deleted email for 30 days after it leaves the Deleted Items folder, keeps deleted OneDrive and SharePoint files for 93 days across two recycle bins, and keeps a deleted user's mailbox and OneDrive for 30 days after the account is removed. After those windows the data is gone unless a retention policy, litigation hold, or a third-party backup preserved it. Those defaults are recycle bins, not backups, and Office 365 deleted email retention surprises a lot of Treasure Coast business owners at the worst possible moment.

How long does Microsoft 365 keep deleted emails?

Email deletion in Exchange Online happens in stages, and each stage has its own clock.

Deleted Items folder. When a user deletes a message it moves here and stays indefinitely by default, unless a retention policy empties it. Many organizations set this folder to clear after 30 days to control mailbox size.
Recoverable Items (the second-stage bin). When a message is removed from Deleted Items, or a user presses Shift+Delete, it goes into a hidden Recoverable Items folder. Users can restore from here themselves in Outlook. The default retention is 14 days, and an administrator can raise it to a maximum of 30 days. That maximum is the ceiling for this mechanism; it cannot be extended beyond 30.
Purged. After the Recoverable Items window, the message is permanently removed unless a hold or retention policy applies. Microsoft support cannot bring it back.

So a message a user deleted and then cleared from Deleted Items in early June is unrecoverable by mid-July on a default tenant. If that message was the only copy of a signed change order, that is a problem.

How long do OneDrive and SharePoint keep deleted files?

Files behave differently from mail, and slightly more generously.

First-stage recycle bin: a deleted file sits here where the user can restore it.
Second-stage (site collection) recycle bin: if the user empties the first bin, the file moves here, where an administrator can restore it.
The two stages share a combined 93-day window from the original deletion. After 93 days the file is permanently gone.

OneDrive also offers a Files Restore feature that can roll an entire OneDrive back to any point in the last 30 days, which is helpful after a ransomware event or a mass accidental deletion. SharePoint document libraries keep version history, which protects against overwrites but not deletions that age past the recycle bins.

Teams is worth a mention because it stores chat in hidden mailbox folders and files in SharePoint or OneDrive, so it inherits those same limits. Deleted channel messages are not recoverable by end users at all without retention policies.

What happens to a deleted user's mailbox and files?

This is where businesses get hurt most often. When an employee leaves and an administrator deletes their Microsoft 365 account:

The account sits in the deleted users list for 30 days and can be restored intact.
The mailbox is kept for 30 days (soft-deleted) and can be recovered along with the account.
The OneDrive is retained for 30 days by default, though administrators can extend this up to ten years in the OneDrive admin settings.

After that, the mailbox and files are permanently deleted. We regularly see the scenario where an office manager deletes a departed employee's account to stop paying the license, and three months later a client asks for correspondence that only lived in that mailbox. The right practice is to convert the mailbox to a shared mailbox (which keeps the mail without a license) or place it on hold before deleting the account, and to transfer OneDrive ownership to a manager.

Can administrators change Microsoft 365 retention settings?

Yes, within limits, and this is what most people mean when they ask about retention.

Extend the Recoverable Items window

Raise the deleted item retention from 14 to 30 days for all mailboxes. Cheap and quick; every tenant should do it.

Use retention policies and labels

Microsoft Purview retention policies (available in Business Premium and most enterprise plans) can keep email, files, and Teams content for a defined period, such as seven years, regardless of user deletion. The content stays discoverable in the Recoverable Items area or a preservation library even if the user thinks it is gone. This is the right tool for regulatory retention in medical, legal, and financial firms, and it works well as long as the policy was applied before the deletion.

Litigation hold

A hold on a specific mailbox preserves everything indefinitely. Useful for a departing employee, a dispute, or a key executive. It does not scale as a backup strategy.

Archive mailboxes

An online archive gives users a second mailbox for older mail and, on the right license, auto-expanding storage. It helps with size, not with deletion.

Why retention policies are not the same as backup

Retention keeps data inside the same tenant, under the same administrator accounts, subject to the same attacks. It does not protect you when:

An attacker gains global admin rights and removes the policies before deleting data.
A retention policy was misconfigured or applied to the wrong group.
You need to restore a whole mailbox or SharePoint site to how it looked last Tuesday, quickly.
Microsoft has a service problem, or your tenant is suspended for a billing or licensing dispute.
You leave Microsoft 365 or merge with another company and need the data in a portable form.

Microsoft's own service agreement recommends that customers use third-party backup. A proper Microsoft 365 backup copies mail, OneDrive, SharePoint, and Teams to independent storage several times a day, keeps it for as long as you choose, and lets you restore a single email, a folder, or an entire mailbox quickly. For small businesses, it is one of the least expensive protections per user and one of the most frequently used.

A practical retention checklist for small businesses

Raise Recoverable Items retention to 30 days on all mailboxes.
Extend deleted-user OneDrive retention from 30 days to a year or more.
Write a departing-employee procedure: convert to shared mailbox or apply hold, transfer OneDrive, then remove the license.
Apply a Purview retention policy that matches your legal and industry requirements, with help from your attorney or compliance advisor on the periods.
Add a third-party backup with daily or more frequent snapshots and test a restore quarterly.
Document all of it for your insurer and auditors.

If you are unsure what your tenant's settings actually are, we can check as part of our Microsoft 365 services. Call MainSail Data at (772) 794-1194 or request a free backup review before the next deleted email becomes the one you needed.