A Vendor Retention Window Is Not a Recovery Plan

Preserve, Transition, Prove

This is the framework we use for changing a Microsoft 365 arrangement without mixing up a license, a vendor's retention period, and your ability to recover.

1. Preserve

Decide what information and services must remain recoverable before any entitlement changes begin.

2. Transition

Change licenses and services in a controlled order, with an approved pilot and a recovery option.

3. Prove

Check that staff can do their normal work, and that the organization can actually recover what leadership said must stay available.

Most licensing conversations blend three ideas together. They are not the same thing.

An entitlement is the right to use a service or feature. A vendor retention or lifecycle window is the period during which the provider may keep your data after a subscription changes or ends. Recovery capability is your own ability to restore or retrieve what you need, in a form and at a speed the organization can live with.

A license can be in place while recovery is untested. A retention window can exist while the data inside it is gone. Only the third item, a recovery you have tested, is something leadership controls.

Start with the facts that apply to your organization, because they changed.

Microsoft's nonprofit program page says the Office 365 E1 and Microsoft 365 Business Premium grants were discontinued in an update dated July 1, 2025. Licenses expire at the next renewal date and do not renew. Microsoft continues to offer up to 300 granted Microsoft 365 Business Basic licenses and discounts of up to 75 percent on many other nonprofit offers. Microsoft told customers to move users to another nonprofit offer before the old subscription was canceled, and said the license replacement is a manual step in the admin center. See Microsoft's nonprofit updates page.

Microsoft's 2026 packaging and pricing update lists these nonprofit prices in U.S. dollars, effective July 1, 2026: Business Basic free, Business Standard $3.50, and Business Premium $5.50. These are Microsoft's published prices and can change. They are not a Bitralynx Solutions quote.

Then read the lifecycle. According to Microsoft's subscription lifecycle guidance (updated June 2026), a subscription moves from Active to Expired to Disabled to Deleted. For most offers in most countries, that is 30 days Expired and 90 days Disabled. In the Disabled state, only admins can reach the data. Once the subscription is deleted, it cannot be reactivated, and buying a new subscription of the same type does not restore the old data. Microsoft also says that when a subscription is canceled, customer data left behind might be deleted after 90 days and will be deleted no later than 180 days. If someone explicitly deletes a subscription, SharePoint and OneDrive data is deleted immediately.

Two cautions matter here. The timelines differ by how the subscription was bought, and Microsoft says exact timing depends on your agreement. For example, Microsoft says that as of February 9, 2026, the Expired stage no longer applies to license based subscriptions bought directly through a Microsoft Customer Agreement. And the same page recommends that you back up your data before it is deleted. The Microsoft Services Agreement says the same thing in plain terms: it recommends that customers regularly back up their content and data.

Read together, these documents describe a window and a warning. They do not describe a recovery service.

Preservation starts with a decision, not a tool. Ask the people who run programs, finance, and compliance what must still exist and be findable if the tenant, the subscription, or the account went away.

Think in categories, not folders. Client and program records. Grant and financial documentation. Personnel files. Email that serves as the official record. Anything a contract, funder, or law requires you to keep.

Then decide where a second copy lives and who owns it. A copy that sits in the same Microsoft environment may protect against deleting a file by accident. Whether it also protects against a subscription lifecycle event is a different question, and one to put to the vendor in writing. Microsoft's own Microsoft 365 Backup is a pay as you go service, listed at $0.15 per GB per month, whose documentation says data stays within the Microsoft 365 data trust boundary. That can be a fit for some risks. It shows why the question has to be asked. It does not answer it.

For many health and human services providers, this is also a compliance question. The federal HIPAA Security Rule's contingency plan standard (45 CFR 164.308(a)(7)) requires a data backup plan that creates and keeps retrievable exact copies of electronic protected health information, plus a disaster recovery plan to restore lost data. Testing of those plans is listed as addressable. If your Microsoft 365 holds case notes, referrals, or billing files for a Long Island behavioral health clinic or an OPWDD provider, ask whether your backup plan leans on the vendor's retention period. It should not.

A small New York law firm on Microsoft 365 faces the same logic, though it would not usually qualify for the nonprofit grant. Rule 1.15(d) requires certain bookkeeping records to be kept for seven years, per NYSBA Ethics Opinion 1192, and a vendor lifecycle is not a way to meet that.

Bitralynx Solutions does not give legal advice. Retention and HIPAA obligations for your organization are questions for counsel, your compliance officer, and your funders.

Once you have decided what to preserve, change the license in a deliberate order.

First, confirm the replacement subscription is present in your tenant, meaning your organization's Microsoft environment. Then assign it to a small, approved pilot group. Include the roles most likely to reveal a mismatch, not just an administrator account. Only after that do you move the wider group. Only after that do you cancel the old subscription.

Keep the old arrangement in place until you have checked the new one. Cancellation, expiration, and deletion are different events with different consequences, and Microsoft's guidance treats them differently.

Also check who receives subscription notices. Press accounts describe administrators who say they never saw warning emails. We cannot verify those individual accounts, but the fix is easy. Make sure notices go to a monitored mailbox that more than one person can read.

Matching licenses to roles still matters. It is the part of the original article that holds up.

Build two inventories. The first covers people and work: who needs desktop applications, who works in a browser, who uses a shared device, and which accounts are administrative, inactive, or used by an integration. The second covers controls: which identity, device, and security arrangements depend on features in the current plan.

Basic, Standard, and Premium are not interchangeable. Business Premium includes security capabilities that the free tier does not, so a role that needs little desktop software may still need a particular safeguard. Having access to a feature also does not mean it is switched on for the right people and devices. Check the assignments, the settings, and the exceptions.

Record why each role has its license and who approves a change.

Most organizations skip this step. It is also the one the recent reports are about.

Pick a small, real sample of what leadership said must stay recoverable. Restore it from the second copy into a clean location. Open the files. Confirm that someone who was not involved in setting up the backup can find them, and write down how long it took.

Do this before the old subscription ends, and again on a schedule. A backup that has never been restored is a hope. A restore test turns it into evidence.

The cheapest license mix is only cheap if it supports the work and the safeguards. A free Business Basic tier may be exactly right for some roles. The budget should still include any paid licenses that certain roles need, plus the cost of the second copy and the test.

Write that fit down so finance, leadership, and the technical contact are all making the same decision.

We bring 15+ years of IT experience, including more than 10 years running technology inside a New York City nonprofit. We have lived through license changes that looked simple on paper. We help nonprofits and small law firms in New York City and Long Island decide what must stay recoverable, change Microsoft 365 licenses in a safe order, and run the test restore that proves it. You get a written record that leadership and auditors can read, and a team that stays with you after the change.

We do not guarantee recovery or compliance outcomes. Microsoft subscriptions remain separate from our managed service rates.

1. Microsoft Learn, Microsoft for Nonprofits Updates (Dec 17, 2025). learn.microsoft.com
2. Microsoft, 2026 Microsoft 365 packaging and pricing updates (Feb 16, 2026). microsoft.com
3. Microsoft Learn, What happens to my data and access when my Microsoft 365 for business subscription ends (June 8, 2026). learn.microsoft.com
4. Microsoft Services Agreement (July 30, 2026). microsoft.com
5. Microsoft Learn, Overview of Microsoft 365 Backup (Aug 18, 2026). learn.microsoft.com
6. The Register, "Microsoft tells nonprofits their deleted M365 data isn't coming back" (Sept 28, 2026). theregister.com
7. Slate, "Microsoft made a quiet change to a popular software grant. Small nonprofits lost everything." (Aug 18, 2026). slate.com
8. Microsoft Learn, Move users to a different subscription (June 29, 2026). learn.microsoft.com
9. 45 CFR 164.308, via Cornell LII. law.cornell.edu
10. NYSBA Ethics Opinion 1192 (June 9, 2020). nysba.org
11. Plain English Technology (Sept 29, 2026). plainenglishtechnology.com
12. Proton blog (Aug 25, 2026). proton.me
13. Microsoft Tech Community discussion (Aug 7, 2026). techcommunity.microsoft.com
14. Full source list and how we check claims: bitralynx.com/research sources