Imagine logging in one morning to find your emails, files and shared documents have vanished, and then being told by the company that looked after them that they’re not coming back. For some small charities and nonprofits, that’s not a “what if”. It’s what actually happened.
At MSL we spend a lot of our time fixing things when they go wrong. This story is a useful reminder that some problems can’t be fixed after the event unless you planned ahead. So here’s what happened, why it matters even if you’re not a charity, and the simple rule that would have saved the day.
What happened?
For years, Microsoft ran a grant that gave eligible nonprofits ten free Microsoft 365 Business Premium licences. In May 2025 it announced that the grant would end at each organisation’s next renewal on or after 1 July 2025, offering instead up to 300 free Microsoft 365 Business Basic licences and discounts on paid plans, including Business Premium. Microsoft urged customers to move users onto another nonprofit plan before cancellation and to export anything they wanted to keep (The Register).
There was meant to be a safety net. Under Microsoft’s standard offboarding process there was a 30-day grace period, followed by a 60-day window before deletion (Gadget Review). That safety net failed.
In an email to one affected customer seen by The Register, Microsoft admitted that, “due to an error”, it had deleted the remaining data before the retention and export window closed. “We have now investigated the recovery options, but unfortunately, the data cannot be recovered,” it said. Microsoft also said it was “currently unable to provide a list showing which data may have been deleted or whether any data was deleted at all” (The Register).
A Microsoft spokesperson confirmed to The Register that “an error resulted in remaining data, if any, being deleted before the retention period had ended”. Microsoft did not say how many nonprofits were affected, how early the deletion happened or what caused the error. What it has offered is a free “concierge service”: a meeting with a Microsoft specialist to help set up a new Microsoft 365 environment. Helpful, but it doesn’t bring anything back. As TechRadar put it, unless the organisations concerned had their own backups, “the situation is irreversible” (TechRadar).
The human cost
Back in August, Slate spoke to nonprofit leaders who had found their Microsoft-hosted data gone. Ronald Khosla, co-founder, president and head of IT at Canopy, a small nonprofit with no paid staff, logged on on 11 June to find that all of Canopy’s data stored with Microsoft had been deleted, even though Microsoft had confirmed he would keep access until 4 October 2026. Support first told him the files could be retrieved, then called back to say they were gone for good (Slate).
Others were less lucky. One child healthcare organisation lost about 500 gigabytes of data, which it hadn’t backed up externally because OneDrive offered automatic syncing. A disability services nonprofit said it would take “hundreds of hours” to re-create lost videos and documents.
Khosla, however, had a yearly habit of copying all of Canopy’s data to an external hard drive, kept on the other side of the country. Getting it back means a flight and some disruption, but as he told Slate: “We’re losing time and money, but we are going to survive.” His backup wasn’t perfect, but it turned a disaster into an inconvenience.
Why this matters to you (even if you’re not a charity)
1. Microsoft looks after the service. You look after your data.
This is known as the shared responsibility model, and Microsoft spells it out itself: “Microsoft provides the availability and durability of the service, while customers are responsible for their data management and protection” (Microsoft Tech Community). In plain English, Microsoft keeps the lights on, but making sure you have a copy of your data is your job.
2. Sync is not backup.
OneDrive, SharePoint and similar tools are brilliant for working from anywhere, but sync copies changes everywhere, including mistakes and deletions. If files are deleted, overwritten or encrypted by ransomware, sync will happily pass that problem on. A backup is a separate copy that you control, which you can roll back to.
3. Retention windows are short, and they’re not yours.
Microsoft says that Microsoft 365 offers restore points for the past 14 days as standard (Microsoft Tech Community). When a user account is deleted, their OneDrive files are kept for 30 days by default (Microsoft Learn). After that, they’re deleted unless settings have been changed or you have your own backup. Gadget Review summed up the lesson nicely: “a retention window is a schedule the vendor controls, while a backup is a copy you control.” This incident shows that even the vendor’s schedule can go wrong.
And it’s not just supplier errors. Accidental deletion, a staff member leaving, a lapsed subscription, a billing mix-up or a cyber attack can all leave you without your data.
The 3-2-1 backup rule, explained
The good news is that protecting yourself isn’t complicated. The long-standing 3-2-1 rule is a simple way to check you’re covered:
Many backup specialists now recommend an upgraded version, 3-2-1-1-0 (Veeam), which adds two more numbers:
1 immutable, offline or air-gapped copy: a copy that can’t be changed or deleted, even by someone who gets hold of an admin password. This is your last line of defence against ransomware.
0 errors: your backups are regularly checked by actually restoring from them. A backup you’ve never tested is really just a hope.
For a typical small business or charity using Microsoft 365, that might look like: your live data in Microsoft 365; a daily backup to an independent Microsoft 365 backup service; and a periodic copy to an encrypted drive that is disconnected and stored off-site. The details will vary, but the principle doesn’t.
Backing up Microsoft 365 properly
Microsoft itself recommends using either its own Microsoft 365 Backup product or “a recognized ISV application”, meaning a third-party backup tool (Microsoft Tech Community).
One well-known option is Veeam Backup for Microsoft 365, which backs up Exchange (email), SharePoint, OneDrive and Teams. Veeam offers it both as self-managed software and as a hosted service, Veeam Data Cloud for Microsoft 365 (Veeam). It’s not the only choice. There are several other reputable Microsoft 365 backup products, and the right one depends on your size, budget and how quickly you’d need to get back up and running.
Whatever you choose, the key point is the same: keep a copy of your data outside your Microsoft 365 subscription, so a licensing change, account problem or supplier error can’t take your backup down with it.
Your quick backup checklist
- Know where your data lives: email, OneDrive, SharePoint, Teams, laptops and any other apps you rely on.
- Check your Microsoft 365 admin contact details are current. Slate reported that Microsoft mainly emailed nonprofits’ admin accounts about the change, so important notices can easily be missed.
- Note your licence renewal dates and read any licensing emails from Microsoft carefully.
- Set up an independent Microsoft 365 backup that runs automatically.
- Keep at least one copy off-site and one offline or immutable.
- Test a restore regularly, for example a few files and a mailbox every quarter.
- Write down who does what if data goes missing, and how to contact them.
- Review it once a year, or whenever you change systems or licences.
References
- The Register, “Microsoft tells nonprofits their deleted M365 data isn’t coming back”, Carly Page, 28 September 2026
- TechRadar, “Microsoft deletes nonprofit customers’ M365 data — and says it can’t get it back”, Christian Cawley, 1 October 2026
- Slate, “Microsoft made a quiet change to a popular software grant. Small nonprofits lost everything.”, Nitish Pahwa, 18 August 2026
- Gadget Review, “Microsoft Deleted Nonprofit M365 Data Early and Says It Cannot Be Recovered”, Annemarije de Boer
- Microsoft Tech Community, “Microsoft 365 Backup: Protect your business with data recovery”, 24 September 2025
- Microsoft Learn, “Compliance for Microsoft 365”
- Veeam, “Immutable Backups & Their Role in Cyber Resilience” (3-2-1-1-0 rule)
- Veeam, “Backup for Microsoft 365” product page
Need a hand applying any of this to your business? Get in touch — call +44 1472 564538 or email services@msl.org.uk.