Raising the Microsoft 365 Backup window applies today. Lowering it deletes backups

The setting that decides most in Microsoft 365 Backup is a dropdown with four values. Upwards it is harmless and applies immediately. Downwards, the documentation calls it by its name: "a destructive action". And if you have never touched it, it sits at one year, because that is the default.

It is called the recovery window and it decides how long Microsoft keeps restore points for everything inside a backup policy. It takes four values: three months, six months, one year or two years. You set it when you create the policy and you can change it later. And the sentence on the Learn page almost nobody reads is this one: "Existing policies and artifacts default to a 1-year recovery window". If your policy was created before the dropdown existed, the window you have today was chosen by nobody on your team.

The same dropdown decides what you keep and what you pay

Microsoft 365 Backup is not licensed per user: it is billed by consumption. The Learn feature table puts it in one line — "$0.15 per GiB per month for all data protected by Backup", and "Restores are free". Note the unit: it says GiB, not GB, and that works in your favour. A gibibyte holds 7.4 % more bytes than a gigabyte, so an estimate done in GB overshoots by that much. Little money per mailbox and a fair amount at the bottom of the sheet.

What turns that price into an invoice is the window. A message somebody deleted in January is still protected data — and therefore billed — until its restore point expires. With the window at two years, that is twenty-four monthly charges for mail that no longer exists. With the window at three months, three. Same content, same price per GiB; what changes is how long you drag it along.

That pushes you naturally towards the short window, which is where the setting turns dangerous.

Raising is reversible. Lowering is not

The full sentence from Learn: "Increasing the recovery window applies immediately. Decreasing the recovery window is a destructive action, because recovery points older than the new window are deleted". It is not that new backups stop being taken. It is that the ones you already have, the ones older than the new window, are deleted.

And there are two ways to trigger that reduction. The first is obvious: you touch the dropdown. The second is the one that matters here, because it looks nothing like a deletion:

Microsoft provides a safety net: "the deletion takes effect only after a 30-day grace period, giving an admin time to review and, if needed, act before any recovery points are removed". Thirty days, plus a multi-admin notification that, per the product overview page, automatically alerts a preset group when a potentially harmful action is taken on the Backup tool. The safety net is there. The question is which mailbox that email lands in and whether anyone opens it, because thirty days is exactly how long it takes for an alert with no owner to get lost.

One operational detail worth knowing before you plan the maintenance window: the recovery window can be changed on an active policy, but "You can't change it on a policy that is paused or has a run in progress". If you paused the policy to do something else, that dropdown is locked.

Two pages of the same documentation disagree

We ran into this reading the two pages back to back. The question is simple: when you take a mailbox out of a backup policy, how long is what was already backed up kept?

There is a hint as to which way this leans, and we offer it as a hint and not as an answer: the policies page states the variable version three more times in other sections — "Existing backups stay available for restore based on your retention settings", "remain restorable until they expire based on their recovery window" and "will remain for its defined retention period" — whereas the fixed year in the FAQ is not repeated anywhere else, and its sibling sentence for SharePoint gives another figure just as fixed, "held for 52 weeks from the time a given restore point was created". The evidence leans one way, but leaning is not saying. We are not going to tell you which of the two wins, because we do not know and it cannot be deduced from the text. What we will say is what the answer depends on and why it matters. If your policy is at three months and the FAQ governs, you are paying four times what you thought for every mailbox you retired. If your policy is at two years and the FAQ governs, the backup you thought you had in month fourteen is not there. Both readings have the same documentation behind them, and the only honest way to close this is to ask it through a support case with your tenant ID and keep the answer in writing.

What the documentation does say without ambiguity, three times on the same page — once per workload: sites, mailboxes and accounts — is the billing part: "Existing backups for those mailboxes aren't deleted and will be charged". Removing a mailbox from the policy stops future backups, but the charge keeps running until what is already stored expires.

The archive going up to 3 TB is not a backup

The other change these weeks is that the Exchange Online auto-expanding archive goes from 1.5 TB to 3 TB per mailbox. Message MC1472592 announces it for the commercial tenant from mid to late October, and MC1521615 does the same for GCC, GCC High and DoD from mid-November to early December. It needs an E5, A5 or G5 licence, one of the Purview bundles, the F5 compliance add-ons, or the eDiscovery & Audit and Insider Risk Management mini suites combined with the Information Protection & Governance one; without one of those, the limit stays at 1.5 TB. And the good part: "No per-GB consumption charge is introduced as part of this change".

That is good news and welcome. What it is not is a backup. An auto-expanding archive is capacity inside the same mailbox: it lives under the same tenant, it is within reach of the same administrator who can make a mistake, and of the same account that can be compromised. Fitting 3 TB instead of 1.5 TB changes none of those three things. It is worth saying that Microsoft does not sell it as a backup either: both messages talk about capacity and licences, and at no point about backup. The confusion is not the vendor's doing, it is the word's.

The Microsoft 365 Backup FAQ also dismantles, one by one, the three substitutes we meet in meetings. Disaster recovery copies: "A DR copy with Microsoft 365 maintains the current state of content, not any historical versions from prior points in time" — they hold the current state, which is precisely what is useless when the current state is the problem. File versions: they do not scale to a mass recovery and "might also be exhausted depending on the version limit set by the admin". And legal holds, the favourite answer of anyone who has already paid for Purview: "optimized for export (for example, via eDiscovery), not for mass restore". They retain what you ask them to, and they do it well; what they do not do is give you back the mail of eight hundred mailboxes on a Tuesday at nine.

And the first question in that FAQ, the one that opens the page, is the one we like most: "Has Microsoft's stance on shared responsibility of data protection changed?". Answer: "No, we still have the same point of view, but are now offering more tools…". The vendor is still saying what it said before it sold the product. Your data is still yours, and so is the backup.

What is not covered, in the vendor's own words

Four limits that are written down and almost never make it onto the requirements sheet:

There is also a nuance about the recovery point objective that gets misread often. The ten minutes for Exchange Online are not a snapshot every ten minutes; the FAQ is blunt: "We're not taking snapshots every 10 minutes". What happens is that all changes to an item are saved as a new version every ten minutes, however many changes occur inside that stretch. With one exception that works in your favour: "The backup frequency does not apply to deletions. All deletions are backed up".

Four questions before you touch the dropdown

The fourth question is the one most often left unanswered, and not out of neglect: the product is well built and it is easy to believe the checkbox already covers everything. It is the same mechanism we described when one checkbox protects a whole workload and the billing base does not match the usage report everybody looks at.

How we approach it

We are not resellers of any particular platform: we recommend based on the case, not on the commission. That said: the native product is good at what it does, which is giving you a lot of data back fast inside the tenant itself. What it does not do, because it was not designed to, is give you a copy that lives outside that tenant and survives somebody with admin credentials deciding to offboard it. For that we work with Proxmox Backup Server and Veeam, with the 3-2-1 rule and genuinely immutable copies, which is what our Backup 365 service is about. Deciding which window you set, what is left out and where the second copy lives is consultancy work, and it is a decision made with figures, not slogans. If you want us to look at your tenant with you, there is the contact form.

If you take one thing from all this, make it the asymmetry of the dropdown. Upwards it costs money and it can be undone. Downwards it is free and it cannot. Most settings in a console look more like the first case, which is why this one gets touched with the same confidence. It is not the same.

Sources. Consulted on 4 November 2026. The four recovery window values, the one-year default for existing policies and artifacts, the sentences about raising and lowering the window, the two ways a reduction can happen, the thirty-day grace period, the fact that it cannot be changed on a paused policy or one with a run in progress, the sentence about removing an artifact from a policy, the repeated note "Existing backups ... will be charged" and the three sentences in other sections that state the variable version of retention come from "Create, view, and edit backup policies in Microsoft 365 Backup" on Microsoft Learn. The $0.15 per GiB per month price, free restores, the recovery point objectives, the scale limits, the multi-admin notification, the ninety-day grace period after offboarding and the sentences about append-only versus immutable storage come from "Overview of Microsoft 365 Backup". The supported mailbox types, the five unsupported SharePoint templates, the one-year retention when a user is removed from the policy, the 52-week sentence for SharePoint, the answers on disaster recovery, versions and legal holds, the one-way transfer of control and the ten-minute nuance come from the Microsoft 365 Backup FAQ. The auto-expanding archive increase from 1.5 TB to 3 TB, the licences required, the absence of a per-GB charge and the rollout dates come from Message Center posts MC1472592 (commercial tenant, mid to late October 2026) and MC1521615 (GCC, GCC High and DoD, mid-November to early December 2026). The contradiction between the policies page and the FAQ over how long removed items are kept is our own reading of the two texts, not a Microsoft statement: that is why we do not say which prevails and recommend confirming it through support. The billing arithmetic (twenty-four monthly charges versus three, the 7.4 % between GB and GiB) is our own calculation over the published price. Quotes are left in their original English so they can be searched verbatim. The social image photograph is "National Archive of Belarus storage 1", by Homoatrox, CC BY-SA 4.0 via Wikimedia Commons.