Cloud Backup in Hong Kong: Microsoft 365 Backup, Retention & Restore Times (2026)

Short answer: Microsoft 365 keeps your service running, but it is not a backup. Microsoft's own documentation, checked on 27 October 2026, says permanently deleted mailbox items are kept for 14 days by default (up to 30), and deleted SharePoint and OneDrive items for 93 days. After that they are gone unless you hold a separate copy. Microsoft's Services Agreement itself recommends that you regularly back up your content and data. For a Hong Kong firm that runs entirely on Microsoft 365, a separate, monitored cloud backup with a tested restore is the safeguard that closes the gap.

Doesn't Microsoft already back up our Microsoft 365 data?

Microsoft protects the service: it keeps the platform available and gives you tools to recover deleted items for a limited time. What it does not promise is to return your data to the state it was in on a date of your choosing, years later, after someone inside or outside your firm has deleted or overwritten it.

The Microsoft Services Agreement, in the section on service availability, says: "We recommend that you regularly backup Your Content and Data that you store on the Services." That is the shared-responsibility line in Microsoft's own words. Microsoft runs the service. You are responsible for your content.

Many Hong Kong small and mid-sized firms assume otherwise, because the data is "in the cloud" and everything works. The gap only shows up on the day a client asks for a file that is no longer there.

What does Microsoft actually keep, and for how long?

The figures below come from Microsoft's documentation, read on 27 October 2026. They change, so check the current pages before you rely on them.

• Deleted mailbox items. If a user permanently deletes an item in Outlook or Outlook on the web, it moves to the Recoverable Items folder and is kept for 14 days by default. An administrator can raise this to a maximum of 30 days. If the mailbox is on litigation hold, the retention limit is ignored. Microsoft documentation.
• Deleted SharePoint and OneDrive files. Items are retained for 93 days from the time they are deleted from their original location, first in the site recycle bin and then in the site collection recycle bin. After that, or if an administrator empties the bin, they are permanently deleted. Microsoft documentation.
• Backups behind the scenes. Microsoft states that SharePoint Online keeps backups of content for 14 additional days beyond deletion, and that a restore from those backups can only be done for whole site collections through Microsoft Support, not for specific files, lists or libraries.
• A departed user's OneDrive. When a user account is deleted, the OneDrive files are preserved for a period an administrator can set between 30 and 3,650 days. Microsoft documentation.

Microsoft also sells its own backup product for Microsoft 365, and the documentation points to it for longer protection times. Whichever product you choose, the point is the same: the built-in recycle bins are a convenience for accidental deletion, not an archive.

What goes wrong in a Hong Kong office?

The cases we see are ordinary, and none of them is a cyberattack.

• The departed partner. A partner or senior employee leaves. IT removes the licence and deletes the account to save the monthly fee. Their mailbox and OneDrive hold years of client correspondence and working papers. The retention window passes, and nobody notices until a client asks for a file from three years ago.
• The emptied recycle bin. Someone clears a shared folder or empties the recycle bin during a tidy-up. The 93 days pass before anyone looks for the file.
• The sync that spread the damage. Ransomware or a faulty sync tool encrypts or overwrites files on a laptop. OneDrive syncs the changed files to the cloud, so the cloud copy is damaged too.
• The overwritten file. A spreadsheet is saved over with the wrong version. Version history helps, but only for as long as versions are kept and only if somebody knows when it happened.
• The mailbox someone cleaned out. A user deletes mail they should have kept, and the 14 days pass.

For a professional-services firm, a missing client file is not an IT inconvenience. It is a service failure.

What do retention policies and litigation hold cover?

Microsoft Purview retention policies and litigation hold are compliance tools. They keep content for a period you set so that it can be searched and produced. They help with some of the scenarios above, and they are worth configuring. They are not the same as a backup, for three reasons:

• They keep what is in the tenant. If the tenant itself is compromised, or an administrator account is taken over, the retained copy sits in the same place as the original.
• They are not designed for point-in-time restore. You can find and export an item. Rolling a mailbox or a library back to the state it was in on a given morning is a different job.
• They depend on the licence level and configuration. Settings differ by plan, and a policy that was never turned on protects nothing.

Use retention for compliance and a backup for recovery. They answer different questions.

What does a real backup add?

A proper Microsoft 365 backup is an independent copy of the data, held outside the tenant, with its own access controls. In practice it adds:

• An independent copy. Backed up to a separate cloud location, so an account takeover or a mistaken deletion in Microsoft 365 does not reach it.
• Point-in-time restore. Choose the date and restore the mailbox, a folder, a SharePoint library or a single file as it was.
• Granular restore. One email, one document or a whole mailbox, without restoring everything.
• Immutability. Backups that cannot be altered or deleted for a set period, which is the main defence when ransomware targets the backups.
• Monitored jobs. Someone is alerted when a job fails, and checks that it was fixed.
• Restore tests. A scheduled test that proves a restore works, because a backup that has never been restored is a hope, not a control.

Which backup option fits a 30 to 60 person firm?

There are three practical options. Compared side by side:

• Native retention only.
• *Cost:* included in the licence.
• *Protects against:* accidental deletion within the retention window.
• *Gaps:* anything older than 14, 30 or 93 days, a deleted user after the retention period, ransomware that syncs, and a compromised tenant.
• *Who checks:* nobody, there is no job to monitor.
• A backup tool you run yourself.
• *Cost:* a per-user software subscription plus your own time.
• *Protects against:* the scenarios above, if you set it up correctly and keep it running.
• *Gaps:* jobs fail silently, restores are untested, and the person who set it up leaves.
• *Who checks:* whoever remembers to.
• Managed cloud backup with monitored jobs and restore tests.
• *Cost:* the software plus a service fee.
• *Protects against:* the same scenarios, with someone accountable for the job running and the restore working.
• *Gaps:* depends on the scope you agree, so write down what is backed up and how often.
• *Who checks:* the provider's monitoring team, with a report you can show a client or an auditor.

For the broader question of managed backup versus buying backup software, with recovery-time arithmetic, read managed backup services vs backup software in Hong Kong.

What does Microsoft 365 backup cost?

Prices vary with the product, the number of users and the term, so ask for a quote that states them. For reference only, Brocent's Acronis pricing page lists a Microsoft 365 cloud-to-cloud backup (mail, OneDrive, SharePoint and Teams) at US$113 for a 5-seat, one-year pack and US$1,726 for a 100-seat, one-year pack, about US$17 per seat per year at that size. That is reference pricing converted from a reseller's published list, observed on 17 July 2026, excluding tax. It covers the software licence only, not a managed service.

Brocent's cloud managed backup service lists a Basic Preventive Maintenance plan from USD 298 per month, covering a monthly backup job health check, backup integrity verification, basic business continuity documentation and an email alert on backup failure. A Standard Managed Backup plan, with 24×7 job monitoring, an annual recovery drill and a monthly status report, is quoted individually. See the backup and recovery pricing hub for the vendor options and their current figures.

What should a Microsoft 365 backup scope list include?

"We back up Microsoft 365" can mean very different things. Before you sign, ask for a written scope that names each workload and what is covered:

• Exchange Online mailboxes. Which mailboxes: user, shared and archive. Whether calendars, contacts and tasks are included.
• OneDrive. Whether every user's OneDrive is included automatically, including new users added later.
• SharePoint sites and Teams files. Which sites and libraries, and whether new sites are picked up without a request.
• Teams chats and channel messages. Often handled differently from files. Confirm whether they are in scope.
• Frequency and retention. How often the backup runs, how long copies are kept and whether older versions can be restored.
• Leavers. Whether the backup keeps a departed user's data after the licence is removed, and for how long.
• Region and access. Where the backup is stored, who at the provider can reach it and how it is encrypted.

The most common gap in a small firm is not the technology. It is that new users and new SharePoint sites are never added to the backup scope, so the people most recently hired are the least protected.

How should client folders on SharePoint be protected?

For a firm that keeps client work in SharePoint, a few habits reduce risk before any backup tool is involved:

• One structure. Keep client files in a consistent library structure so that backup scope and restore requests are predictable.
• Limit who can delete. Give most staff edit rights without the ability to delete whole folders or libraries, and keep owners few.
• Use versioning. Make sure version history is on for client libraries, and know how many versions are kept.
• Name an owner. Each client site has a named owner who is accountable for its content, and who is replaced when they leave.
• Test a restore. Ask for a restore of one client folder from a date you choose and time it. This is the best single test of any backup.

These steps do not replace a backup. They make the backup easier to scope and the restore easier to run.

How does the arithmetic look for a 40-person firm?

Do the comparison with your own numbers, not an average. Estimate the following and put them side by side:

• The cost of one lost client file. Staff time to rebuild it, the client relationship and any fee concession. Even a single serious case can exceed a year of backup subscription.
• The software cost. A per-user annual price multiplied by your headcount, from the reference figures above or a quote.
• The management cost. Your own time to run and check jobs, or the service fee for a managed plan.
• The risk you accept. If you rely on native retention, name who accepts the risk that data older than a few months cannot be restored, and write it down.

For most 30 to 60 person firms the decision comes down to whether anyone will actually check the jobs and test the restore every quarter. If the honest answer is "probably not", a managed service is the practical choice.

Who owns restore testing?

Somebody has to own it, and it should be written down. A workable routine for a small firm:

• Monthly: review the backup report and confirm every job ran.
• Quarterly: restore one mailbox item and one file from a random date, and record how long it took.
• Yearly: run a recovery drill for a larger scenario, such as a whole mailbox or a document library, and check it against the time you told the business to expect.
• After every change: a new licence plan, a new SharePoint structure or a new tenant setting can change what is covered. Check the backup scope.

In Brocent's managed service this is part of the monitoring and recovery drill, so the evidence exists when a client or auditor asks.

Why does backup come before licence removal?

Offboarding is where the data loss usually starts. The safe order when someone leaves:

• Convert and keep. Convert the mailbox to a shared mailbox, or transfer ownership of the OneDrive to a manager, before the licence goes.
• Back up first. Confirm a current backup exists for the account.
• Set the retention. Decide how long the departed user's OneDrive is preserved and set it, knowing that the administrator setting ranges from 30 to 3,650 days.
• Then remove the licence. Record the date and the decision.

Make this a checklist step in the leaver process, owned by IT or the practice manager, not something remembered on the day.

How does this relate to ransomware?

Ransomware that reaches a laptop with OneDrive sync can encrypt files that then sync to the cloud. Version history and the recycle bin can sometimes recover them, but a large incident can exceed what is practical to roll back by hand. An immutable, independent backup gives you a clean copy to restore from. It also lets you decline to negotiate, because the data is recoverable. Back this up with the other basics: multifactor authentication, a review of your Microsoft 365 security settings and staff awareness. Brocent's Microsoft 365 security audit covers the configuration side.

Case study: a 45-person accounting practice

*This is an illustrative example, not a named client.* A 45-person Hong Kong accounting practice ran entirely on Microsoft 365: Exchange for email, SharePoint for client folders, OneDrive for working files and Teams. A partner left the firm, and IT removed the licence the following week. Fourteen months later, a client asked for a set of working papers from a past engagement that had been in the former partner's OneDrive. The retention period had passed. The practice rebuilt the file from the client's copy and the other partner's emails, which took several days. It then added a monitored cloud backup, a leaver checklist that backs up before removing a licence, and a quarterly restore test.

Frequently asked questions

Doesn't Microsoft back up our data?

Microsoft keeps the service available and provides recycle bins and retention features for a limited time. Its Services Agreement recommends that you regularly back up your content and data. A separate backup is how you protect against deletion, overwrites and ransomware beyond those windows.

How long does Microsoft keep deleted items?

As of 27 October 2026, Microsoft's documentation says permanently deleted mailbox items are kept for 14 days by default, up to 30 days, and deleted SharePoint and OneDrive items for 93 days. A deleted user's OneDrive is preserved for a period the administrator sets between 30 and 3,650 days. Check the current documentation before relying on these figures.

Where is the backup stored?

In a separate cloud location outside your Microsoft 365 tenant. Ask any provider which cloud and region hold the data, and how access to the backup is controlled.

Can we restore one email, or only a whole mailbox?

A good backup supports granular restore: a single email, a folder, one file or a whole mailbox. Confirm that in the scope before you sign.

What does it cost per user?

It depends on the product and term. As a reference, a 100-seat one-year Microsoft 365 backup licence is listed at about US$17 per seat per year on our Acronis pricing page, observed on 17 July 2026. A managed service adds monitoring and restore tests on top.

Who checks that the backup jobs ran?

In a managed service, the provider's monitoring team and a regular report. If you run a tool yourself, you need a named person and a monthly check, or jobs can fail without anyone noticing.

Does backup help after ransomware?

Yes, if the backup is independent of the tenant and immutable. It gives you a clean copy to restore from, instead of relying on version history and recycle bins alone.

Next steps

Read how the service works on the cloud managed backup page, compare vendor options and figures on the backup and recovery pricing hub, and see how Microsoft 365 fits into a managed plan on the managed IT cloud services page. For a backup scoped to your tenant and number of users, talk to a consultant.