The news
Microsoft (MSFT) has told nonprofits that an error deleted any remaining Microsoft 365 data from their expired grant subscriptions before the retention period ended, and that the data cannot be recovered, according to a report The Register published on September 28, 2026.
The affected subscriptions came from the Microsoft 365 Business Premium grant, a donated-license program for nonprofits that Microsoft discontinued. In a statement to The Register, Microsoft said that after the applicable notice periods concluded and the subscriptions were terminated, "an error resulted in remaining data, if any, being deleted before the retention period had ended."
In an email to customers seen by The Register, Microsoft said it had investigated recovery options but that the data cannot be recovered. It also said it cannot yet tell customers what, if anything, was deleted. Microsoft did not disclose how many organizations were affected.
Microsoft is offering affected nonprofits a free concierge service, a session with a Microsoft specialist to help set up a new Microsoft 365 environment and answer questions, The Register reported. That support does not restore deleted content.
The grant's retirement was announced in May 2025, The Register said. Microsoft's nonprofit program page states that Business Premium grant licenses expire at an organization's next renewal date and will not renew, and it strongly recommended moving users to another nonprofit offer before cancellation to avoid disruption and data loss. Microsoft still offers nonprofits up to 300 granted Microsoft 365 Business Basic licenses and discounts of up to 75% on other plans, the page says.
The numbers
- Organizations affected
- Not disclosed
- Granted Business Basic licenses still available to nonprofits (per Microsoft)
- Up to 300
- Nonprofit discount on other Microsoft 365 offers (per Microsoft)
- Up to 75%
Why CEOs should care
For CIOs at any organization, not only nonprofits, the lesson is that a vendor's post-cancellation retention window is a courtesy, not a backup. When you change licenses, retire a tenant or let a subscription lapse, export mail, files and records first and verify the export before the cutoff. If you rely on Microsoft 365 as your system of record, keep an independent backup that you control, and test restores on a schedule. Nonprofits with small IT teams should ask a partner to confirm that no other grant-based subscriptions are nearing expiry.
For compliance officers and CISOs, early deletion can create a records problem even when no attacker is involved. Organizations with legal holds, grant-reporting duties or donor-privacy obligations should confirm that required records exist outside the affected tenant. Review your contracts and Microsoft's product terms for what the company commits to on retention, and what remedy, if any, applies when it misses that commitment.
For CFOs and boards, vendor program changes carry hidden migration costs. Retiring a free or discounted license tier can force moves that consume staff time and create data risk. Ask management to keep a register of vendor programs your organization depends on, with owners, renewal dates and exit plans.
The bigger picture
Cloud software concentrates both convenience and control with the vendor. Microsoft's own nonprofit updates page records two rounds of program changes: a cut in Azure sponsorship credits from $3,500 to $2,000 for renewals with sponsorship end dates on or after October 1, 2023, along with the end of the Dynamics 365 Sales Enterprise grant that day, and then the discontinuation of the Office 365 E1 and Business Premium grants in an update dated July 1, 2025. Each change pushes customers through a migration, and each migration is a moment when data can be lost.
Microsoft attributes the deletion to an error, and nothing in the reports suggests outside access to the data. As described, it is an operational failure inside the vendor's own subscription lifecycle, which is harder for customers to anticipate or monitor than an external attack.
What’s next
Watch for whether Microsoft discloses how many organizations were affected, offers any compensation beyond the concierge service, or changes how it handles retention when grant or promotional subscriptions end. Nonprofits that believe they lost data should document the impact now and keep copies of Microsoft's notices. Organizations that recently ended any Microsoft 365 subscription should also confirm what remains in the tenant.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
Companies in this story
