Email Archiving vs Backup: Retention Policies Explained

The subpoena asks for every email a former sales manager sent in 2021, and the mailbox was deleted two years ago. The backup tool kept ninety days, the license was removed the week she left, and Microsoft purged the rest on schedule. That is the gap between backup and email archiving, and a written retention policy is how you close it before someone with a court date asks.

TL;DR

• A backup is a point-in-time copy you restore from. An archive is a complete, searchable, tamper-evident record you produce from. One tool rarely does both jobs well.
• Microsoft 365 is not a backup, and Microsoft says so. Out of the box, deleted mail is recoverable for 14 days and a deleted user's mailbox is gone after 30, unless a hold or retention policy was on it first.
• Retention periods come from the rules you sit under: 3 years for broker-dealer communications under SEC 17a-4, 6 years under FINRA 4511, 6 years for HIPAA documentation, 5 years for audit workpapers under Sarbanes-Oxley. GDPR pushes the other way: keep personal data no longer than needed.
• Write the retention policy first. Then pick between native retention, a third-party archive fed by journaling, and a backup, based on what the policy has to prove.
• Legal holds stop every clock. Put the hold on before you offboard, or there is nothing left to hold.

Archive vs Backup: Two Jobs, Not Two Names for One

Backup answers one question: can we put it back? A backup takes a copy of a mailbox at a point in time so you can restore it after ransomware, a bad migration or an admin's slip. It is measured in restore time and how much you lose between copies, the RTO and RPO pair covered in our RTO vs RPO guide.

An archive answers a different question: can we prove what was sent? An archive captures every message as it passes through, keeps it unchanged for a set period, indexes it so a lawyer can search it, and records who looked at it. Nobody restores from an archive. They search it, export the results and hand them over.

The differences show up in the details. A backup holds whatever was in the mailbox when the copy ran, so a message deleted between two backups may never appear in either. An archive captures the message on arrival, so deletion by the user does not matter. A backup ages out after its retention window, usually weeks or months. An archive keeps to a schedule set by law and policy, usually years. A backup is restored by IT. An archive is searched by legal, HR or compliance, often without IT in the room.

Microsoft's own documentation draws the same line. Exchange Online "does not provide a way to perform a traditional backup of mailboxes," and there is "no way to restore a mailbox to the state the mailbox was in when the backup was taken." What it offers instead is retention, holds and archive mailboxes. That is the archive side. For the backup side, our post on Microsoft 365 backup covers what Microsoft protects and what it leaves to you.

What Microsoft 365 Keeps by Default

Before you buy anything, know what the platform already does with mail, because the defaults surprise people in both directions.

Two rows carry most of the risk. The 30-day rule after account deletion is where departed employees' mail disappears, because the hold has to exist before the account goes. And the archive mailbox is storage, not compliance: it moves old mail out of the way, but a user can still delete from it unless a hold or retention policy stops them.

Licensing decides which of those tools you have. Archive mailboxes come with Exchange Online Plan 2, Microsoft 365 Business Premium, E3 and E5. Business Basic, Business Standard, Exchange Online Plan 1 and F3 need the Exchange Online Archiving add-on to get the archive, auto-expanding storage and litigation hold. Microsoft's Purview service description, dated August 2026, lists retention policies under Business Premium, E3 and E5 as well.

This r/msp thread is the licensing question in its natural habitat: a local government client on Exchange Online Plan 1, and a subpoena that could arrive five years from now.

The replies split the way this post does. One camp says move everyone to Plan 2 and turn on litigation hold, then let the mailbox go inactive when the user leaves. The other says keep the forever copy in the backup or a dedicated archive, because a permanent hold fills Recoverable Items over the years and the platform's search was never built for lawyers.

Retention Policy: Write the Rules Before You Buy the Tool

A retention policy is a short document that says which classes of mail you keep, for how long, where, and what happens at the end. Every tool decision follows from it, which is why writing it second costs money: teams buy a backup with 90-day retention, then discover the auditor wants seven years.

A usable policy has five parts.

1. Scope. Which mailboxes and which message types: user mail, shared mailboxes, Teams chat, calendar items, attachments.
2. Classes and periods. Most mail falls into three or four buckets: routine business mail, financial and contractual mail, regulated mail (trades, patient communications, HR), and personal or transient mail. Each bucket gets a period and a reason.
3. Trigger. When the clock starts: on receipt, on last modification, or on an event such as an employee leaving or a contract ending.
4. End of life. What happens when the period runs out: delete, move to cold storage, or review before disposal. If nothing deletes, you have a hoarding policy, not a retention policy.
5. Holds. Who can pause the clock, how they ask, and how the hold is recorded and released.

In Microsoft 365 the policy is enforced by Purview retention policies, which can retain, delete, or retain then delete. Two rules decide conflicts, and both matter when you layer policies: retention always wins over deletion, and the longest retention period wins. Microsoft documents both under "the principles of retention," updated July 2026, and they explain why a delete-after-one-year policy does nothing to a mailbox that is also on a seven-year hold.

The hard part is not the settings page. It is the argument with users who want to keep everything, which this r/sysadmin thread from July 2026 captures: mailboxes with 60,000 messages going back to 2011, and a company that had never written down a retention schedule.

The replies land where a written policy would have started: the schedule is compliance's decision to make and IT's to enforce, and a mailbox with no deletion rule is a discovery liability, not an asset.

Jonathan Edwards walks through setting a Microsoft 365 retention policy end to end, which is the practical half of this section:

Retention Periods the Regulators Set

Nobody has to guess the numbers for regulated mail. The rules publish them.

Three things to read out of that table. First, the SEC's WORM rule (write once, read many) is why regulated firms buy dedicated archives: the 2022 amendments added an audit-trail alternative, announced on October 12, 2022, but either way the record has to be provably unaltered. A backup that can be restored and re-run does not qualify on its own. Second, HIPAA's six years applies to the documentation the rule requires, not to every email a clinic sends; medical record retention comes from state law. Third, GDPR turns retention into a two-sided problem. Keeping mail forever is a violation for the personal data inside it, so the policy needs a deletion rule as much as a keep rule.

If none of those rules names your client, the period still is not zero. Contract disputes, employment claims and tax audits set their own windows, and the safe move is to ask the client's counsel for a number and write it into the policy. Our post on IT compliance covers how to turn a framework into evidence you can hand over.

eDiscovery and Legal Holds: When the Clock Stops

Retention runs on a schedule. A legal hold pauses it. When litigation is reasonably anticipated, the organisation has a duty to preserve relevant records, and the tooling has to make that possible in an afternoon.

In Microsoft 365, a hold stops the Managed Folder Assistant from purging anything from Recoverable Items, and it turns on copy-on-write, so an edited message keeps its original version alongside the edit. Litigation hold covers a whole mailbox. An eDiscovery hold from a Purview case can be scoped to a query, a date range or a set of custodians. Google Vault works the same way at the top level: holds take precedence over retention rules, and when a hold is removed the data goes straight back under the retention schedule.

The order of operations is the part that fails. A hold protects what exists when it lands. If the user was offboarded last quarter and nobody put a hold on first, the 30-day window has closed and the mailbox is gone from the platform. The only remaining copy lives in whatever backup or archive was running at the time, which is why an offboarding checklist should have a "confirm hold, then delete account" step rather than a "delete account" step.

Microsoft's recommended route for departed staff is to apply a retention policy or label, confirm the hold has applied, then remove the account, which converts the mailbox into an inactive mailbox that needs no license. The confirm step is not ceremony: if the policy has not finished distributing, the mailbox will not go inactive, and the deletion proceeds as normal.

Native, Third-Party Archive or Backup: Which One You Need

Most organisations need two of the three, and the retention policy tells you which two.

Native retention alone fits a business with no external regulator, a Business Premium or E3 licence, and a policy measured in a few years. Purview retention policies keep and delete on schedule, the archive mailbox handles storage, and eDiscovery (Standard) gives legal a search and export tool. What it does not give you is a copy outside Microsoft's tenant or a restore to a point in time.

A third-party archive fits regulated firms and anyone who needs mail captured on arrival, kept in a WORM or audit-trailed store, and searchable by non-admins with a chain of custody. It is fed by journaling: Exchange Online generates a journal report for every message that matches a rule and sends it to the archive. Microsoft's own page, updated May 2026, says the journaling mailbox cannot be an Exchange Online mailbox, so the archive has to live outside the tenant, and it recommends Microsoft 365 retention instead where that meets the requirement. The trade-off is the overhead: monitoring non-delivery reports, deduplicating in hybrid setups, and paying per seat for years.

A backup fits everyone who has ever needed a mailbox back the way it was on Tuesday. Ransomware in a synced mailbox, a migration that mangled folders, a mail flow rule that deleted the wrong things: retention policies keep the messages, but they do not reassemble a mailbox. Pick one with retention long enough to matter and storage the attacker cannot delete, which is the case our post on immutable backups makes in detail.

The pairing that keeps coming up in practice: native retention plus a backup for most small businesses, and a third-party archive plus a backup for anyone under SEC, FINRA or a state records law. Backup on its own is the combination that fails the subpoena, because it keeps the wrong thing for the wrong length of time.

One habit that undermines all three: PST files. Exporting mail to PST on a laptop takes it out of every hold, every search and every backup schedule at once, which is why Microsoft's own guidance says not to use PSTs as a backup. OpenFrame can run a script across a client's devices and collect the output, so an inventory of stray .pst files across a fleet is a ten-minute job rather than a guess.

A Retention Policy Template You Can Fill In This Week

Copy this into a document, fill in the right column with counsel's numbers, and attach it to the client's contract.

Keep the reasons next to the numbers. When someone asks why marketing's mail is deleted after three years and finance's is kept for seven, the answer should be in the document, not in a former admin's memory.

The Short Version

Backup gets a mailbox back. Archive proves what was in it. Microsoft 365 provides the second half natively for licensed tenants and none of the first half, and it deletes a departed user's mail after 30 days unless a hold got there first. Write the retention policy from the rules that apply, then buy the tools the policy needs: native retention plus a backup for most, a journaled archive plus a backup for the regulated. And treat the "confirm hold" step on the offboarding checklist as the one that cannot be skipped.

FAQ

Is email archiving the same as backup?

No. A backup is a point-in-time copy of a mailbox used to restore it after loss. An email archive captures every message as it arrives and keeps it unchanged and searchable for a set period, so it can be produced for an audit or lawsuit. A message deleted between two backups may not exist in either; an archive has it regardless.

Does Microsoft 365 back up email?

Not in the traditional sense. Microsoft's documentation says Exchange Online has no way to restore a mailbox to the state it was in at an earlier time. It protects against hardware failure with replicated copies and against accidental deletion with a 14-day recoverable window, extendable to 30 days, plus holds and retention policies for longer periods.

How long should a business keep emails?

As long as the rules that apply say, and no longer than the policy states. Broker-dealers keep communications 3 years under SEC 17a-4 and 6 years for unspecified records under FINRA 4511. HIPAA requires 6 years for its required documentation. Audit workpapers are 5 years under Sarbanes-Oxley. Unregulated businesses usually settle on 3 to 7 years with counsel, with a deletion rule so personal data does not sit forever.

What is a legal hold on email?

A legal hold pauses deletion for mailboxes or messages relevant to actual or anticipated litigation. In Microsoft 365, litigation hold covers a whole mailbox and an eDiscovery hold can be scoped by query or custodian; both stop automated purging and keep original versions of edited items. The hold has to be applied before the content is deleted, so it belongs on the offboarding checklist ahead of account removal.

What happens to a former employee's email in Microsoft 365?

If nothing was in place, the mailbox data is kept 30 days after the account is deleted, then removed. If a retention policy, retention label or litigation hold was applied before deletion, the mailbox becomes an inactive mailbox and is retained for the policy's period without a license, and it stays searchable for eDiscovery.