Microsoft 365 gives SharePoint admins two overlapping layers of deleted-content protection. Understanding where one ends and the other begins determines how quickly you can recover files, and whether you need to spend anything beyond your existing licence.
| Feature | SharePoint Recycle Bin | Microsoft 365 Backup |
|---|---|---|
| Cost | Included with all Microsoft 365 plans | Paid add-on; priced per GB of protected data per month |
| Retention period | 93 days from deletion (first + second stage combined) | Up to 1 year (configurable) |
| Restore granularity | Individual files, folders, or list items | Site-level or OneDrive restore (not single-file) |
| User-initiated restore | Yes (users can restore their own items) | No - admin-only operation |
| Recovers from ransomware | No (only deleted items, not corrupted or overwritten files) | Yes (restores to a snapshot taken before the attack) |
| Recovers overwritten files | Partial (version history covers overwrites, not bin) | Yes (snapshot-based) |
| Covers Exchange Online | No | Yes |
| Covers OneDrive for Business | Yes (separate per-user bin, 93-day window) | Yes (longer retention, snapshot model) |
| Setup required | None - always active | Admin must enable, configure retention, and allocate storage |
| Storage counts toward tenant quota | Yes - deleted items count against site quota | No - stored in separate Microsoft-managed capacity |
How SharePoint's built-in recycle bins work
SharePoint Online operates two recycle bin stages for every site collection, and they share a single 93-day retention clock. Knowing which stage holds your file determines who can access it and how.
First-stage bin
Items land in the first-stage bin the moment a user or process deletes them. Site members can see all items in the bin and restore them to their original location; users who want to clear their own items can manually "empty" the bin, which moves those items to the second stage rather than permanently removing them. After 93 days from original deletion, SharePoint automatically purges whatever remains.
One important detail many admins miss: deleted items in the first-stage bin still count against the site collection's storage quota. A site that is approaching its quota limit will not be relieved by having users delete files; the quota pressure stays until those items either expire or an admin clears the bin.
Second-stage bin
The second-stage bin is the admin-only layer - items arrive here when a user empties the first-stage bin. Only site collection administrators can see and restore from it. The 93-day clock keeps running from the original deletion date: reaching the second stage adds no extra time, so an item can still expire while it sits there.
For a full step-by-step guide to accessing the second-stage bin, including the direct URL shortcut and access permission requirements, see How to access the SharePoint second-stage recycle bin.
How Microsoft 365 Backup works
Microsoft 365 Backup is a separately licensed add-on that provides point-in-time snapshot restores for SharePoint Online, OneDrive for Business, and Exchange Online. It is not a replacement for the recycle bin; it is a complementary layer that covers scenarios the recycle bin cannot handle.
Microsoft 365 Backup takes regular snapshots of your Microsoft 365 data and stores them in Microsoft-managed capacity, separate from your tenant's storage quota. Admins can configure the retention period (up to one year) and initiate restores from the Microsoft 365 admin center. Restores are site-level or drive-level operations, not individual file operations.
Key scenarios where Microsoft 365 Backup is the right tool rather than the recycle bin:
- A ransomware attack has encrypted or corrupted files that still technically "exist" in the file system. The recycle bin only holds deleted items; corrupted files that were never deleted are not in the bin.
- A bulk operation overwrote hundreds of documents and version history is insufficient to roll back all of them to a consistent point in time.
- Files were deleted more than 93 days ago and the recycle bin window has expired.
- A site was permanently deleted (not just the files within it). Site deletion recovery through Microsoft 365 Backup provides a cleaner restore path than native site recovery options.
Side-by-side feature comparison
| Recovery scenario | Recycle bin handles it? | Microsoft 365 Backup handles it? |
|---|---|---|
| User deleted a single file within 93 days | Yes - first-stage bin, self-service | Yes - but site-level restore is overkill |
| User emptied the bin (file still within 93 days) | Yes - second-stage bin, admin access needed | Yes - but again, an overengineered response |
| File was deleted more than 93 days ago | No | Yes, if retention was configured to cover that date |
| Ransomware corrupted files without deleting them | No | Yes |
| A script overwrote metadata across thousands of items | No (items still exist, just changed) | Yes - restore from a pre-overwrite snapshot |
| A site collection was accidentally deleted | Partial - SharePoint has a native 30-day site recovery window | Yes - clean restore within configured retention period |
| Bulk file recovery (hundreds of files, known date range) | Yes - with a tool like Recycle Master for bulk operations | Yes - but triggers a full site restore rather than targeted files |
When the recycle bin is enough
For the large majority of file recovery requests, the recycle bin is the right tool. A user accidentally deleted a document, a sync client removed a folder, a list item was overwritten: all of these have the item in the first-stage or second-stage bin, and they all resolve within minutes when the admin knows where to look.
The recycle bin also has the advantage of granularity. You can restore a single file to its original path without affecting anything else on the site. Microsoft 365 Backup restores operate at the site or drive level, which means recovering one document may require accepting a rollback of the entire site to an earlier state, potentially overwriting recent legitimate changes made by other users.
For tenants using ShareMaster, the Recycle Master tool extends what the native recycle bin can do: it adds indexed search across all site bins simultaneously, date-range and user-based filtering, and bulk restore across many sites in one pass. Most "impossible to find" recovery requests become straightforward once the entire bin is indexed and queryable.
When Microsoft 365 Backup fills the gap
Microsoft 365 Backup earns its cost in three situations the recycle bin structurally cannot cover:
- Long retention requirements. Regulated industries where files must be recoverable for longer than 93 days need a backup layer. Microsoft Purview retention policies can prevent deletion, but they are compliance controls, not recovery tools. Microsoft 365 Backup provides the point-in-time restore capability for content that was never deleted but needs to be rolled back.
- Corruption and ransomware. The recycle bin only holds items that were explicitly deleted through SharePoint. Files damaged in place by malware or a runaway process sit outside the bin entirely. Only a snapshot-based backup can restore those files to their pre-corruption state.
- Site-level disasters. When a whole site is destroyed, misconfigured, or overwritten at scale, a site-level restore from a backup is faster and more reliable than attempting to restore thousands of individual items from the recycle bin.
Decision matrix: which to reach for
| Your situation | Start here |
|---|---|
| File deleted in the last 93 days, deletion date known | SharePoint Recycle Bin (first-stage) |
| File deleted in the last 93 days, user emptied the bin | SharePoint Recycle Bin (second-stage, admin access required) |
| File deleted in the last 93 days, hard to find across many sites | Recycle Master (indexed search across all bins) |
| File deleted more than 93 days ago | Microsoft 365 Backup (if subscribed) or third-party backup |
| Files corrupted or overwritten by malware | Microsoft 365 Backup |
| Entire site overwritten or corrupted at scale | Microsoft 365 Backup or SharePoint admin center site restore |
| Recycle bin approaching quota limit, need immediate space | Recycle Master bulk clear (then reassess backup strategy) |
Both layers are worth having. The recycle bin handles the overwhelming majority of day-to-day recovery requests at no extra cost. Microsoft 365 Backup covers the scenarios that fall outside the 93-day window and protects against corruption events that the recycle bin was never designed to catch. They work best in combination.