Microsoft 365 and Google Workspace backup: what's covered

Part of our Backup and recovery guide. See all guides.

Microsoft 365 and Google Workspace both keep deleted data for a while, and both are built to survive hardware failures. But the windows for getting deleted data back are short, and keeping copies for resilience is not the same as a backup you control. This guide sets out what each platform keeps, for how long, and where the gaps are.

Who is responsible for your data in the cloud?

Microsoft's shared responsibility model is the clearest statement of the principle. It says some responsibilities transfer to the provider as you move to the cloud, but that you are responsible for protecting the security of your data and identities, on-premises resources, and the cloud components you control. Microsoft says that holds for all cloud deployment types, including software as a service, platform as a service, infrastructure as a service and on-premises.

In practice the provider looks after the platform: data centres, hardware and keeping the service running. Microsoft says OneDrive, SharePoint and Exchange Online keep replicated copies of customer data so they can fail over to live copies without customer intervention. That protects against Microsoft's hardware failing. That is resilience against failure, not a backup you control.

What Microsoft 365 keeps, and for how long

Exchange Online email. Deleted Outlook items go first to the Deleted Items folder, and after that to the Recoverable Items folder. How long each step lasts depends on your organisation's policies. Microsoft gives an example of a policy that deletes anything in Deleted Items after 30 days, and another that lets users recover items from Recoverable Items for up to another 14 days. It also notes you cannot recover a folder that has been permanently deleted, only the messages from it.

SharePoint and Teams files. Microsoft says items in SharePoint in Microsoft 365 are retained for 93 days from the time you delete them from their original location. They sit in the site Recycle Bin, and if someone empties that, in the site collection Recycle Bin for the rest of the 93 days. After that, or if they are deleted from the second stage, they are permanently deleted.

OneDrive. The Restore your OneDrive feature can undo all the actions on files and folders within the last 30 days, which covers files that were deleted, overwritten, corrupted or infected by malware.

Those are recycle bins and undo windows. They help when someone notices a problem quickly. They do not help when you find out after the window has closed, which could happen with ransomware that sits quietly, a leaver whose files nobody checks, or a sync mistake spotted at year end. Our backup retention policy guide covers how far back you might need to go.

Microsoft 365 Backup

Microsoft sells a separate product, Microsoft 365 Backup, that backs up all or selected SharePoint sites, OneDrive accounts and Exchange mailboxes. Microsoft says it can restore SharePoint sites and OneDrive accounts to their exact state at prior points in time, and restore whole mailboxes or individual items, including fully deleted ones.

Microsoft says the backups use append-only storage, so SharePoint can only add new content and cannot change old content until it is permanently deleted, and that, although deletion is not blocked, the backups are immutable unless expressly deleted by the backup tool admin through product offboarding. It also says partner applications can be built on the same Microsoft 365 Backup Storage platform.

Note what that product is: a backup kept within Microsoft's own service boundary. Microsoft says the data never leaves the Microsoft 365 data trust boundary. In our view, whether that is enough depends on your risk, and some organisations will also want a copy held elsewhere, in line with the 3-2-1 rule. Our 3-2-1 backup rule guide explains why.

What Google Workspace keeps, and for how long

Gmail. Google says that when a user deletes a Gmail message, it stays in their Trash for 30 days. When that period ends, admins have an additional 25 days to restore messages using the Restore data tool in the Admin console. That 25-day period starts 30 days after the message was deleted. When it ends, Google says messages are permanently deleted and cannot be restored by an admin or by Google, and that for privacy reasons it does not store account data past that point.

Google Drive. Google's Drive help says files remain in Trash for 30 days, then they are deleted forever.

Google Vault is not a backup

Google Vault is often mistaken for a backup. Google describes it as an information governance and eDiscovery tool that can retain, hold, search and export users' Workspace data, and says plainly that Vault isn't a data archive.

Vault retention rules control how long data is preserved, for a set number of days or indefinitely, and holds take precedence over retention rules. But Google's Gmail guidance says that while you can search for and export retained data from Vault, you cannot directly restore it to the user's Gmail account. When a retention period ends, any data deleted by users or admins that is not on hold goes through standard deletion, and Google says it cannot then be recovered by users or admins.

So Vault helps you keep data for legal or compliance reasons. It is not a quick way to put a mailbox or a shared drive back the way it was.

Where the gaps are

Putting the platform features together, the gaps that a separate backup closes are:

• Time. Built-in recovery windows are mostly measured in weeks, such as 30 days for OneDrive restores and 93 days in SharePoint. Problems found later are not covered.
• Scale. Restoring one file from a recycle bin is easy. Rolling back thousands of encrypted files across many users is a different job, which is why Microsoft offers its separate Microsoft 365 Backup product.
• Leavers. When accounts are deleted, their data follows the platform's deletion rules. In our view, decide before someone leaves how long their mailbox and files must be kept, and make sure your backup or retention rules cover it.
• Restores, not only retention. Vault and similar tools keep data for compliance. They do not put it back in place.

What to do

1. Write down the windows. For each service you use, note how long deleted data can be recovered, using the figures above and your own retention settings.
2. Decide how far back you need to go. If the answer is longer than the built-in windows, you need a backup.
3. Choose a backup that can restore in place. That could be the provider's own backup product or another one. Check it covers the services you rely on, such as mail, files and Teams or shared drives.
4. Keep its credentials separate. Use a dedicated admin account with multi-factor authentication for the backup tool, not an everyday account.
5. Test a restore. Restore a mailbox and a shared folder at least once, and time it. Our guide to how often to test disaster recovery plans covers testing.

FAQ

Does Microsoft back up my Microsoft 365 data?

Microsoft keeps deleted items for limited periods, such as 93 days in SharePoint, and its services keep replicated copies for resilience. Its shared responsibility model says you are responsible for protecting your data. Microsoft 365 Backup is a separate product for point-in-time backups.

How long can a Google Workspace admin restore deleted email?

A deleted message stays in the user's Trash for 30 days. Admins then have an additional 25 days to restore it with the Restore data tool. After that, Google says it is permanently deleted and cannot be restored by an admin or by Google.

Is Google Vault a backup?

No. Google says Vault is not a data archive. It retains, holds, searches and exports data, but retained data cannot be restored directly to a user's Gmail account.

How long does SharePoint keep deleted files?

Microsoft says items are retained for 93 days from the time you delete them from their original location, across the site Recycle Bin and the site collection Recycle Bin.

Do I need a third-party backup for Microsoft 365 or Google Workspace?

In our view, you need a backup that sits outside the short deletion windows, whether that is a provider's own backup product or another one. The built-in windows cover accidental deletion found quickly, not problems found weeks or months later.