Someone quits. You wish them well, you collect the key, you shut off their email. A week or two later you delete the account, because it is tidy and it is one less license to pay for. Then, months down the road, a customer asks about a quote from 2023, or your supplier list turns out to have lived only in that person's OneDrive.
By then the clock has run out. Microsoft's own instructions for restoring a deleted user account say the account and all of its data come back "when you restore a user account within 30 days of deleting it." A month. That is the whole window.
Nobody thinks of that as a disaster. It is a Tuesday.
Your email has a second, shorter clock
Even inside a live mailbox, deleted mail does not sit there forever. Microsoft's documentation for Exchange Online says the default deleted item retention period is 14 days, and that it can be extended to a maximum of 30. Calendar items get longer. Either way, there is a limit, and it is documented, and almost nobody has read it.
So there are two timers inside a system most owners describe as "the cloud, so it's fine." One is 14 days. One is 30. Neither of those is a backup. They are a grace period, and they are the reason the sentence "we can always get it back" is worth testing before you actually need it.
Microsoft said the quiet part out loud
Microsoft's own guidance on Microsoft 365 backup puts recovery in the customer's column. Their best practices whitepaper explains that because the customer is the controller of the data, recovering from customer-side problems, whether that is a ransomware attack or a case of mistaken deletion, requires a restore solution that the customer chooses.
Read that plainly. The service staying up is their job. Your data is your job. Those are two different jobs, and only one of them is covered by the subscription you already pay for.
The confidence is not the problem
The U.S. Chamber of Commerce Foundation and Verizon surveyed 2,005 small business owners and decision-makers in March 2026, and published the results in May. Ninety-four percent of owners said they believed they would recover from a disaster. Sixty-nine percent had no disaster plan at all. Thirty-six percent said they could not keep paying employees beyond one month.
In the same survey, owners guessed that getting prepared would cost about 30% of annual revenue, when the realistic number is closer to 5%. Most of that gap is not stubbornness. It is not knowing what the first step looks like. Sixty-five percent of them had never asked anyone for help with it.
What "offline" actually means
CISA's guidance is blunt on this. Maintain offline, encrypted backups of critical data, and regularly test that you can really restore from them. Then they give the reason. Many ransomware variants go looking specifically for accessible backups, so they can delete or encrypt those and leave you with no way back except paying.
Offline means the copy cannot be reached from your network. Not a folder on the same server. Not a mapped drive. Not the same cloud account, with the same login, that everything else already uses. It means a second copy somewhere the infection cannot crawl to.
If you have heard the phrase immutable backup and wondered what it meant, that is what it means: a copy an attacker cannot alter or delete, because it is not sitting anywhere they can reach it.
Three things to check before Friday
Write down the clock. Before you delete anyone's account, decide who needs what out of it, and export the mailbox and their files first. It takes a few minutes, and it is the entire difference between a mild inconvenience and losing records you cannot rebuild.
Count your timers. Know which systems keep their own short history and which ones have no second copy at all. Email, calendars, files, the accounting system, the scheduling tool, the one piece of software the whole shop runs on.
Ask the ugly question out loud. If the office flooded tonight, or the server died, or one person clicked the wrong link, what order would you bring things back in, and who would do it? If the answer is "the guy who set it up, I think," that is a real answer. It is just worth knowing now instead of on the morning you need it.
You do not need new software for most of this. You need to know where you stand. The 30 days is not the disaster. It is what the disaster costs when nobody was watching the clock.