Recovery – CIAOPS

Understanding Native Recovery vs. Backup

It’s crucial to understand that Microsoft 365’s native features focus on data retention, versioning, and recovery from accidental deletion or modification, primarily for compliance, legal holds, and user errors. They are not a traditional point-in-time backup solution that protects against all scenarios (like widespread ransomware encryption beyond versioning limits, catastrophic service failures, or malicious admin actions wiping configurations). Microsoft operates on a Shared Responsibility Model.

Key Concepts for Maximizing Native Recovery Time

Retention Policies (Microsoft Purview): This is the MOST IMPORTANT tool for maximizing recovery time. Retention policies ensure data is kept for a specified period, regardless of user actions (like deletion). Data subject to a retention policy is typically moved to a hidden, preserved location when deleted by a user.
Litigation Hold / In-Place Hold: Similar to retention policies but often used for specific legal cases. They preserve all mailbox or site content indefinitely or until the hold is removed. Holds generally override deletion policies.
Versioning: Automatically saves previous versions of files in SharePoint Online and OneDrive for Business, allowing users to restore older copies.
Recycle Bins: A two-stage system for deleted items/files, providing a buffer before permanent deletion.
Recoverable Items Folder (Exchange Online): A special folder in user mailboxes that stores deleted items, items purged from Deleted Items, and modified versions of items (if Single Item Recovery is enabled).

Configuration Steps for Maximum Recovery Time (Service by Service)

1. Exchange Online (Email, Calendar, Contacts, Tasks)

Configure Retention Policies (Microsoft Purview Compliance Portal):
- Goal: Keep email data for the longest possible duration required by your organization (e.g., 7 years, 10 years, or even indefinitely for specific regulatory needs).
- How:
  - Go to the Microsoft Purview compliance portal (compliance.microsoft.com).
  - Navigate to Data lifecycle management > Microsoft 365 > Retention policies.
  - Create a new policy.
  - Name & Description: Give it a clear name (e.g., “Exchange – Max Retention”).
  - Locations: Select Exchange mailboxes. Choose specific mailboxes or apply to all.
  - Retention Settings:
    - Choose Retain items for a specific period.
    - Select Forever or the maximum duration required (e.g., 10 years).
    - Set Retain items based on: Choose When items were created or When items were last modified based on your needs.
    - At end of retention period: Choose Do nothing (if you only want retention) or Delete items automatically (if you need cleanup after the retention period). For maximum recovery potential during the period, “Do nothing” is simpler, relying on deletion actions triggering preservation.
  - Review and create the policy. Allow time for it to apply (can take up to 24 hours, sometimes longer for large organizations).
Configure Recoverable Items Folder Quota & Retention:
- The default retention for items in the Recoverable Items folder (when not under hold/retention policy) is 14 days, extendable to 30 days via PowerShell.
- However, if a mailbox is subject to a Retention Policy (set to Retain) or Litigation Hold, items are kept in the Recoverable Items folder (specifically the Purges or DiscoveryHolds subfolders) effectively indefinitely or for the duration of the policy/hold, regardless of the 14/30 day setting. The main limit becomes the storage quota.
- Increase Quota (If Necessary): The default quota is 30 GB, with an auto-expanding archive providing an additional 100 GB (up to 1.5 TB for certain licenses). For very high-volume mailboxes under indefinite hold, you might monitor this, but it’s usually sufficient. Use PowerShell Set-Mailbox <mailbox_identity> -RecoverableItemsQuota <value> -RecoverableItemsWarningQuota <value> if needed, though holds often trigger the auto-expansion.
Enable Litigation Hold (Alternative/Supplement to Retention Policies):
- Can be enabled per mailbox via the Exchange Admin Center or PowerShell (Set-Mailbox <mailbox_identity> -LitigationHoldEnabled $true -LitigationHoldDuration <days> or leave duration off for indefinite).
- Often used for specific users/cases but achieves similar preservation to a “Retain Forever” policy.
Deleted Mailbox Retention: By default, deleted mailboxes are kept for 30 days (soft-deleted) and can be recovered during this period. This is generally fixed.

2. SharePoint Online (Team Sites, Communication Sites, Document Libraries)

Configure Retention Policies (Microsoft Purview Compliance Portal):
- Goal: Retain documents and site content long-term.
- How:
  - Similar to Exchange, create a Retention Policy in Purview.
  - Locations: Select SharePoint classic and communication sites. Choose specific sites or apply to all.
  - Retention Settings: Choose Retain items for a specific period (e.g., Forever, 10 years) based on Created date or Last modified date. Choose Do nothing or Delete at the end of the period.
  - Preservation Hold Library: When a retention policy is active, deleted or modified content is preserved in this hidden library within the site collection, consuming storage quota.
Configure Versioning:
- Goal: Allow restoration of previous file versions.
- How:
  - Go to the Document Library settings > Versioning settings.
  - Ensure Create major versions is enabled.
  - Set Keep the following number of major versions: Increase this significantly. The technical maximum is 50,000, but a high number like 500 or 1000 is usually practical and provides substantial recovery capability. Consider storage implications.
  - You can also enable minor versions if needed, but major versions are key for rollback.
Recycle Bin Settings:
- The total retention time for the user Recycle Bin + Second-Stage Recycle Bin (Site Collection Recycle Bin) is 93 days. This is generally not configurable per site. Items automatically move from the first to the second stage after 30 days (unless emptied sooner) and are purged after the total 93 days. Retention Policies/Holds override this purging for covered content.

3. OneDrive for Business (User Personal Files)

Configuration is very similar to SharePoint Online:
- Retention Policies (Purview): Create policies targeting OneDrive accounts. Apply to specific users or all users. Set long retention periods.
- Versioning: Enabled by default, typically storing 500 versions. You can verify/adjust this in the user’s OneDrive Settings > Return to Classic OneDrive > Library Settings > Versioning Settings (though accessing this directly might change). The key is that high versioning is usually on by default.
- Recycle Bin: Same 93-day, two-stage process as SharePoint, generally not configurable.
- Files Restore: A key OneDrive (and SharePoint Library) feature allowing users/admins to restore the entire OneDrive/Library to a point in time within the last 30 days. This is excellent for mass deletion/corruption/ransomware recovery within that window. It relies on version history.
- Deleted User OneDrive Retention: When a user account is deleted, their OneDrive content is retained for a default of 30 days (configurable up to 3650 days / 10 years via SharePoint Admin Center > Settings > OneDrive Retention). Access can be delegated to a manager during this time. After this period, the OneDrive enters a deletion process unless under a hold/retention policy. Configure this setting to your maximum desired timeframe.

4. Microsoft Teams (Chats, Channel Messages, Files)

Data Storage: Understand where Teams data lives:
- 1:1 and Group Chats: Stored in hidden folders within the participants’ Exchange Online mailboxes.
- Standard Channel Messages: Stored in a hidden folder within the Microsoft 365 Group mailbox associated with the Team.
- Private/Shared Channel Messages: Stored in dedicated mailboxes associated with those channels (or user mailboxes for shared channels).
- Files (Standard Channels): Stored in the associated SharePoint Team site’s Document Library (in a folder named after the channel).
- Files (1:1/Group Chats): Stored in the OneDrive for Business account of the user sharing the file.
- Files (Private/Shared Channels): Stored in dedicated SharePoint sites associated with those channels.
Configure Retention Policies (Purview):
- You MUST configure retention policies specifically for Teams data, in addition to Exchange/SharePoint policies.
- Create a policy targeting:
  - Teams channel messages: Covers standard/private/shared channel conversations.
  - Teams chats: Covers 1:1 and group chats (including Teams meeting chats).
- Set your desired long retention period (e.g., Forever, 10 years).
- Important: Ensure your Exchange and SharePoint/OneDrive retention policies also cover the underlying storage locations for comprehensive protection.

Native Recovery Methods (Without Third-Party Tools)

Exchange Online:

Deleted Items Folder: User recovers recently deleted items (Outlook/OWA).
Recover Deleted Items: User recovers items purged from Deleted Items or hard-deleted (Shift+Del), accessing the Recoverable Items Folder (Outlook/OWA). Limited by the 14/30 day window unless under hold/retention.
Restore Deleted Mailbox: Admin recovers a soft-deleted mailbox within 30 days (Admin Center/PowerShell).
eDiscovery Search (Purview): Admins (with permissions) search for and export mailbox content preserved by Retention Policies or Litigation Holds, even if deleted by the user years ago. This is the primary method for long-term recovery under retention.
Recover Mailbox Items (PowerShell): Admins can use Search-Mailbox (older) or New-ComplianceSearch + New-ComplianceSearchAction -Purge -PurgeType SoftDelete/HardDelete (newer, more complex) to find and potentially recover specific items, often from the Recoverable Items folder. New-MailboxRestoreRequest can restore content from a soft-deleted or inactive mailbox to another mailbox.

SharePoint Online / OneDrive for Business:

Recycle Bin (First Stage): User restores their own deleted files/items from the site/OneDrive Recycle Bin.
Second-Stage Recycle Bin: Site Collection Admin restores items deleted from the first-stage Recycle Bin. (Total 93-day window combined).
Restore Previous Version: User/Admin restores a file to an earlier state using the version history (available via File > Version History in Office apps, or the context menu in SharePoint/OneDrive web).
Files Restore (OneDrive & SharePoint Libraries): User (OneDrive) or Site Admin (SharePoint Library) restores the entire OneDrive or Document Library content to a previous point in time within the last 30 days. Excellent for mass deletions/changes. Access via Settings gear > Restore your OneDrive / Restore this library.
Restore Deleted Site: Admin restores a deleted SharePoint site collection within 93 days (SharePoint Admin Center > Deleted sites).
eDiscovery Search (Purview): Admins search for and export documents/items preserved by Retention Policies or Holds from SharePoint sites/OneDrive accounts, even if deleted from Recycle Bins. Primary method for long-term recovery under retention.
Preservation Hold Library Access (Advanced/Admin): While not a typical user recovery method, admins can sometimes access this hidden library (usually via URL manipulation or eDiscovery) to find preserved versions if standard methods fail, though eDiscovery is preferred.
Restore Deleted OneDrive: Admin restores a soft-deleted OneDrive (within the configured retention period) or delegates access (Admin Center).

Microsoft Teams:

Undo Delete (Chats/Messages): Users have a very short window (seconds/minutes) to undo deleting their own message.
File Recovery: Use the SharePoint/OneDrive methods above (Recycle Bins, Versioning, Files Restore) in the corresponding file storage location.
eDiscovery Search (Purview): Admins search for and export Teams messages/chats preserved by Retention Policies. This is the primary method for recovering deleted conversations beyond the user’s ability.

Summary & Key Takeaways

Retention Policies are Paramount: Configure comprehensive retention policies in Microsoft Purview targeting Exchange, SharePoint, OneDrive, and Teams locations. Set retention durations to meet your maximum recovery time objective (e.g., 7 years, 10 years, Forever).
Leverage Versioning: Ensure SharePoint/OneDrive versioning is enabled with a high number of versions (e.g., 500+).
Understand Recycle Bins: Know the 93-day limit and the two stages.
Utilize Files Restore/Site Restore: This is powerful for recent (within 30 days) mass recovery scenarios.
Configure Deleted User Data Retention: Set appropriate retention for deleted OneDrive accounts and understand the 30-day mailbox retention.
Master eDiscovery: This Purview tool is essential for finding and recovering data preserved long-term by holds and retention policies.
Limitations: Remember native tools aren’t full backups. They don’t easily restore entire service configurations, protect against all ransomware scenarios perfectly, or offer granular point-in-time restores for all data types easily outside the specific features mentioned (like Files Restore).

By carefully configuring these native features, particularly retention policies and versioning, you can significantly extend the window for data recovery within Microsoft 365 without relying on third-party backup solutions. Always test your recovery procedures.