Backing up Google Workspace or Microsoft 365: do you need to?

Short answer: Google and Microsoft keep your data running and replicated, but their undo buttons only reach back a few weeks: roughly 30 days of trash plus 25 days of admin recovery in Google Workspace, and 14 to 30 days for deleted Outlook items or 93 days in the OneDrive and SharePoint recycle bin in Microsoft 365. If nobody would notice a deletion inside those windows, or if losing a departed colleague's mailbox would hurt, you need a separate backup. For most small teams that means one of the providers' own backup add-ons or a third-party cloud-to-cloud backup, plus a written restore test.

Five things that actually go wrong

Outages at Google or Microsoft are rare and are their problem to fix. The losses small teams suffer are usually self-inflicted or slow-burning:

The quiet deletion. Someone tidies a shared folder in March. In June a client asks for a file that was in it.
The departed colleague. A licence is removed to save money, the account is deleted, and months of emails and Drive files go with it.
The ransomware sync. Files on a laptop are encrypted, the sync client faithfully uploads the scrambled versions, and the cloud copies are now useless.
The angry or careless admin. One person with full rights empties things that weren't theirs to empty.
The locked-out account. The only admin loses their phone and second factor, and the business can't reach its own data for days.

Ask of each one: would the built-in tools get us back, and in time?

What the built-in tools cover (as of November 2026)

Google Workspace

Gmail: deleted messages sit in Trash for 30 days, where users can recover them. After that, admins have an additional 25 days to restore messages with the Restore data tool in the Admin console. When that period ends, Google says the messages are permanently deleted and can't be restored by an admin or by Google.
Drive: admins can recover items within 25 days after a user empties their trash. Restores work on a date range, not individual files, and only one restoration project can run at a time.
Deleted users: Drive files of a deleted account can be restored within 20 days of the account deletion.
Google Vault: if your edition includes Vault and you've set retention rules, you may be able to search and export retained mail later, but Google notes it can't be restored directly into the user's mailbox. Vault is a retention and search tool, not a one-click backup.
Data Export: the Admin console's Data Export tool can export your organisation's data to a Google Cloud Storage archive, available in all editions per Google's admin help. It's a snapshot, useful before closing accounts or as an occasional archive, not a daily backup.

Microsoft 365

Outlook/Exchange Online: deleted items move to the Recoverable Items folder, kept for 14 days by default; admins can raise this to a maximum of 30 days per mailbox.
OneDrive and SharePoint: for work or school accounts, deleted files can be restored for 93 days unless the administrator changed the retention setting.
Deleted users: restoring a user within 30 days of deletion brings back the account and associated data, including the mailbox.
Microsoft 365 Backup: a separate, paid add-on that backs up OneDrive, SharePoint and Exchange with point-in-time recovery points; Microsoft's overview describes default retention of one year (configurable) and frequent recovery points for recent weeks. Billing is based on the amount of data protected, so check Microsoft's current page before budgeting.

So where are the gaps?

Put the scenarios against those windows:

Scenario	Built-in recovery?
File deleted yesterday	Yes, from trash or recycle bin
Email deleted 45 days ago (Google)	Possibly, inside the extra 25-day admin window
Email deleted 45 days ago (Microsoft, default settings)	No, beyond 14–30 days
Folder deleted four months ago	No, on either platform without Vault/retention or a backup
Account of a leaver deleted six weeks ago	No (20 days Drive on Google, 30 days on Microsoft)
Ransomware-encrypted files synced to the cloud	Partly, via version history, but slow at scale
Admin locked out	Not a backup problem; needs a second admin and recovery options

The pattern is clear: built-in tools are good at "oops, five minutes ago" and poor at "we noticed months later".

Your options

Change your habits and settings, at no extra cost. Never delete leavers' accounts straight away; transfer their files and mail to a manager first (see our staff offboarding checklist). On Microsoft, raise mailbox deleted-item retention towards 30 days. Keep two admin accounts with different recovery methods.
Use the provider's own add-on. Microsoft 365 Backup on Microsoft; Vault retention rules on Google editions that include it. These stay inside the same ecosystem, which is convenient but means one company holds everything.
Use a third-party cloud-to-cloud backup. Many services back up Gmail, Drive, Outlook, OneDrive and SharePoint daily to separate storage, with longer retention and per-item restore. Compare restore speed, where the data is stored, how admin access is protected, and what happens to backups if you stop paying.
Take occasional exports. A Data Export on Google, or the equivalent export tools in Microsoft's admin centres, before a big change or after someone leaves gives you an offline archive. Store it somewhere other than the same account.

A simple setup for a team of 5 to 25

Decide what matters: shared drives or SharePoint sites with client work, the finance mailbox, the owner's mailbox.
Pick one backup method and turn it on for all users, not just the "important" ones. People leave unexpectedly.
Set retention long enough to cover how late you tend to notice problems. If clients come back after a year, a 30-day backup isn't enough.
Protect the backup admin login with a strong passkey or security key, separate from your day-to-day admin.
Write one page: where backups live, who can restore, and how.
Test a restore of one file, one email and one whole mailbox every quarter. A backup you have never restored from is a hope, not a plan.

FAQ

Isn't my data already backed up because it's in the cloud?

It's replicated, which protects against Google or Microsoft losing hardware. It doesn't protect against you or your staff deleting, overwriting or encrypting the data, because those changes replicate too.

Is Google Takeout a backup?

Takeout lets individual users download their own data. It's handy for one-off copies, but it isn't automated, doesn't cover the whole organisation in one go and is easy to forget.

How long should we keep backups?

Long enough to cover the latest point at which someone might realise something is missing. For most service businesses that's at least a year; check whether any client contracts ask for more.

Do we need to back up shared drives and Teams files?

Yes. They often hold the most important client work and are frequently left out because they don't belong to one user.

If you want someone to map what your team would lose today and set up a backup you've actually tested, start with a short note about your setup.