Your Comprehensive Guide to Microsoft 365 Data Retention Policies

As one of the most popular productivity application suites, Microsoft 365 (formerly known as Office 365) allows you to easily share and collaborate with stakeholders on everything from crucial business and operational documents to daily emails, files, voice messages, and posts.

With a vast amount of information being traded back and forth on Microsoft 365, what happens if data is accidentally deleted? How can you recover it? If it’s beyond the retention period, will you violate industry compliance and regulation standards?

It is imperative to understand Microsoft 365’s data retention policies to ensure you have access to all of your data when you need it most.

Microsoft 365 Data Retention

Microsoft 365 Data Handling Standard Policy states how long a user’s data is retained once deleted.

Typically, there are two instances of customer data deletion:

• Active Deletion: When tenants have an active subscription and an administrator, or a user deletes the data, or in some cases, a user is deleted by an administrator.
• Passive Deletion: The subscription period of the tenant expires.

Customer data includes all the content created or provided by the users or the admins. It consists of all the text, image files, sound video, and the software deployed and stored in the data center when using Microsoft 365 services.

The most frequently used Microsoft 365 accounts that allow users to create data include:

• OneNote
• PowerPoint
• Word
• Outlook
• Excel

(Exchange and SharePoint operate on slightly different retention standards, we’ll address this later in the blog.)

Other content includes customer’s passwords, encryption keys, certificates, and storage keys.

In an active deletion scenario, the retention period is only 30 days, whereas, with passive deletion, it’s no more than 180 days.

Exchange Online Data Deletion and Retention

Exchange Online has two kinds of deletion:

• Soft deletion
• Hard deletion

This includes the mailbox itself and then all of the data stored within the mailboxes.

Mailboxes: Soft Deleted And Hard Deleted

Any file that is deleted via the Remove-Mailbox cmdlet or Microsoft 365’s admin center is known as the soft-deleted mailbox.

Soft deleted data remains in the recycle bin of Azure Active Directory for full 30 days. A hard delete occurs when a mailbox has been soft-deleted for more than 30 days – after which all data is erased and becomes irretrievable.

If the user mailbox associated with a user account gets hard deleted from the Azure Active Directory, it is then in Exchange Online’s soft-deleted state. The retention length to recover the lost data is 30 days.

After 30 days, the mailbox is hard deleted, which means all the mailbox content, such as contacts, files, and emails, are permanently deleted.

The above deletion situations presume that the mailbox wasn’t on any hold settings. If a mailbox is, then it is not valid for deletion and can’t be purged.

Mailbox Items: Soft Deleted And Hard Deleted

When a user deletes a mailbox item (a contact, an email message, a calendar appointment, or a task), that particular item is transferred to the Recoverable Items Folder. Under this, there is a subfolder labeled as “Deletion,” and is considered a soft deletion.

How long an item stays in the “Deletion” folder varies on the specific item’s retention time in the mailbox settings.

By default, the Exchange Online mailbox retains the removed items for 14 days. But the Exchange Online admins can adjust this setting and increase the retention period for the mailbox up to a max of 30 days.

SharePoint Online Data Retention

SharePoint Online retains an item for 93 days from when you delete it from its initial location. The item is moved to the Recycle Bin until (or unless) it is removed.

In that case, mailbox items are then moved to the Recycle Bin’s site collection, where they are kept for the remaining 93 days. In SharePoint Online, the retention time of Recycle Bin is not configurable.

If you unintentionally delete a site collection, it can be retrieved by a global or SharePoint administrator through the SharePoint admin center.

Like other data, the deleted site collections are also retrievable for 93 days. Once the 93 days are over, the site and its content, such as libraries, lists, subsites, and pages, are permanently deleted.

When it comes to hard deletion, items from Recycle Bin’s site collection are deleted when the backup and retention periods end, or when an admin makes permanent deletion of the site collection.

Skype for Business Data Retention and Deletion

The archiving capability of Skype for Business is customized to cater to the platform’s style. Archived data consists of instant messages and uploaded files in a meeting.

This feature is labeled “user-level archiving” because it allows you to adjust the archiving information for specific groups or users.

Meeting Content – Retention Policy

Skype for business allows customers to upload the content to a meeting as files or attachments, such as OneNote files, PowerPoint presentations, or other documents. A user’s ability to access a meeting’s information after it ends is subjected to each meeting’s expiration interval.

The retention length for meeting content is as follows:

• One-time meeting – The content is kept for 15 days from the moment the very last participant leaves the meeting.
• Recurring meeting – The content is preserved for 15 days after the last person leaves the meeting’s final conference. If someone participates in the same meeting, the retention timer resets the session in 15 days.
• Meet Now meeting – The content is held for 8 hours once the session ends.

Want to dive even deeper? Our free eBook, Backupify for Office 365: Return of the Data, addresses the most common causes of data loss in Microsoft Office 365, Exchange Online, OneDrive, & SharePoint.