A cloud suite protects your data from hardware failure, not from your own mistakes. Microsoft's own documentation says most data loss results from customer actions, so deleted files, overwritten documents and departed staff accounts are your problem. A small organization should decide what it cannot lose and keep a copy somewhere separate.
Resilience is not the same as a backup
Microsoft describes Microsoft 365 as built with redundancy: separate copies of customer data in different fault zones, monitoring for corruption, and recovery tools. That protects you if a datacenter component fails.
It does not protect you if a volunteer deletes a shared folder, a staff member leaves and their account is removed, or a ransomware process encrypts files that sync from a laptop. In those cases the cloud faithfully replicates the damage.
Microsoft says it plainly: most data loss results from customer actions, so it gives customers a way to restore accidentally deleted items themselves.
What the built in recovery gives you
For SharePoint in Microsoft 365, deleted items sit in a recycle bin for 93 days from the time you delete them. Items moved to the second stage bin stay for the rest of that 93 day period.
That is a useful safety net for a mistake you notice within a few months. It is a poor fit for a mistake you notice in month five, such as a donor spreadsheet that quietly lost half its rows.
Check the retention settings for your own tenant and for each service (mail, files, chat). Defaults differ, and an administrator can change them. Do not assume the numbers in a blog post match your account.
Decide what is worth a second copy
Start with the data you listed in your inventory: donor or member records, financial files, signed agreements, grant reports, and anything a funder or regulator expects you to keep.
Ask three questions for each set.
- How long could we go without it?
- How far back might we need to go?
- Who could delete or encrypt it, on purpose or by accident?
Anything with a short tolerance or a long lookback needs a copy outside the account that holds the original.
Practical options without a big budget
You have three broad approaches, from cheapest to most complete.
Scheduled exports. Export key mailboxes, contact lists and the donor database on a calendar, and store them encrypted on a separate account or offline drive. Cheap, manual, easy to forget.
Copy to a second storage account. Sync important folders to storage under different credentials, with versioning on. If one admin account is taken over, the second copy survives.
A dedicated backup service for the suite. It costs money but runs without anyone remembering. Evaluate it the way you would any vendor: who can access the copies, where they live, and how you restore.
CISA's Cyber Essentials points the same way: establish regular automated backups of key systems, and protect them with physical security, encryption and offline copies. It also tells leaders to test the plan often.
Test one restore
Pick a real file and restore it from the second copy, not from the recycle bin. Time it. Write down the steps on one page and print it.
If the restore fails, you learned that on a quiet Tuesday and not during an incident.
Quick check
Does Microsoft 365 keep my deleted files forever?
No. For SharePoint in Microsoft 365, deleted items are retained for 93 days. After that they are gone unless you have a separate copy or a retention policy that keeps them.
If my files sync to the cloud, am I backed up?
Not necessarily. Sync copies changes, including deletions and encrypted files. A backup is a separate, versioned copy that a bad change cannot overwrite.
If your files also contain software projects, Safeguard offers a free scan at gold.safeguard.sh/scan for dependency risk. For a broader plan, see the first 90 days for a nonprofit.
Sources
- Data Resiliency in Microsoft 365, Microsoft Learn
- Restore deleted items from the site collection recycle bin, Microsoft Support
- CISA Cyber Essentials
Last reviewed: 19 October 2026.
