SF3TECHNOLOGIES
GuidesGuides · Backup and recovery

Is Microsoft 365 or Google Workspace backed up? What is kept, for how long, and what is not

Microsoft and Google keep your service running and give you recycle bins and version history, but neither one is a backup in the sense your accountant or insurer means. Here is what they keep, for how long, where the gaps are, and how to decide if your company needs more.

8 minute readUpdated

The short answer

Microsoft and Google keep their service running. Getting your data back is a shared job.

  1. Deleted email and files survive in recycle bins and version history for days to a few months, then they are gone.
  2. Nothing protects you from a deletion nobody noticed in time, a ransomware attack that encrypted synced files, or a closed account whose data expired.
  3. Both vendors describe this as shared responsibility and point you to retention policies, Vault or a separate backup.

Decide by consequence, not by fear: if losing three months of email or the finance folder would hurt, back it up. If you could shrug, the built-in tools and a retention policy may do.

What "backed up" means to Microsoft and Google

Both companies run your email and files on redundant systems in several data centers. If a disk, a server or a whole building fails, you never notice. That is availability, and both vendors are excellent at it.

Neither vendor promises to restore data your company lost through its own actions after their retention periods end. Microsoft describes this as shared responsibility: it secures the platform, and the customer owns its data and the decision to back it up. Google's documentation makes the same point in other words. They look after the platform, you look after the data in it.

What Microsoft 365 keeps, and for how long

What happenedWhat saves youHow long
Deleted an emailDeleted Items folder, then Recoverable ItemsUntil you empty Deleted Items, then 14 days by default, which an admin can raise to 30
Deleted a file in OneDrive or SharePointRecycle bin, then the second-stage recycle bin93 days in total
Overwrote a fileVersion history500 versions by default in SharePoint and OneDrive
Ransomware encrypted synced filesRestore your OneDrive, and the same Restore this library option in SharePoint, which rolls everything back to a dateWithin 30 days of the attack
Deleted a whole user accountThe account sits in a deleted state and can be restored with mailbox and OneDrive30 days after deletion
A leaver's mailbox after the license was removedA 30-day grace period, unless the mailbox was made inactive with a retention policy or converted to a shared mailbox first30 days after the license is removed, then deleted
Teams chats and channel messagesKept in hidden mailbox folders, recoverable by an admin onlyFollows the retention policy; a deleted team can be restored for 30 days

Two things are worth knowing. The 14-day mailbox window is a default, and raising it to 30 days takes an admin two minutes. And a retention policy, included in Business Premium and E3 or E5 plans, can keep everything a user deletes for one, three or seven years, invisible to the user and searchable by an admin. That is real protection against deletion, though not against a tenant you cannot sign in to.

What Google Workspace keeps, and for how long

What happenedWhat saves youHow long
Deleted an emailTrash, then the admin's restore tool30 days in Trash, then up to 25 more days for an admin
Deleted a file in DriveTrash, then the admin's restore tool30 days in Trash, then up to 25 more days for an admin
Overwrote a fileVersion history for Google Docs, Sheets and Slides; up to 100 versions or 30 days for other filesDocs, Sheets and Slides: effectively unlimited; uploaded files: 30 days unless you pin a version
Deleted a whole user accountAdmin can restore the user with mail and Drive20 days after deletion
A leaver's filesTransfer ownership when deleting the user, or move to a shared drive firstDeleted with the account if not transferred
Ransomware encrypted synced filesNo whole-drive rollback; restore files one by one from version history30 days for uploaded files
Chat messagesFollows Vault retention if you have VaultIncluded in Business Plus and Enterprise; an add-on on Starter and Standard

Google Vault, included in Business Plus and the Enterprise plans and sold as an add-on for Business Starter and Standard, is the equivalent of Microsoft's retention policies: it keeps mail, files and chat for as long as the rule says, whatever the user deletes. It is a retention and legal hold tool, not a restore button for an everyday mistake, and it protects nothing if the Workspace subscription itself is cancelled.

The gaps the built-in tools do not cover

  • Deletions nobody noticed in time. A folder removed in March that someone asks for in July is past every window above. Most data loss in small companies is exactly this kind, slow and quiet.
  • Ransomware and compromised accounts. An attacker who signs in as a user can empty recycle bins, delete versions and purge Recoverable Items. OneDrive's rollback helps if you act within 30 days and the attacker did not have admin rights. Google has no equivalent rollback.
  • Offboarding mistakes. Removing a leaver's license before preserving the mailbox, or deleting a Google user without transferring files, loses the data when the grace period ends. Very common, and entirely avoidable with a checklist.
  • Losing access to the tenant itself. A hijacked admin account, an unpaid subscription, or a dispute with the reseller can lock you out of everything at once. Retention policies and Vault live inside the tenant, so they are locked out with you.
  • Records you must keep for years. Tax law, SOX, HIPAA, GDPR accountability or a client contract may require seven years of email or finance files. Retention policies can do that inside the tenant, a backup can do it outside, and auditors prefer having both.
  • Things outside mail and files. Planner boards, Forms, Teams settings, Intune policies, Google Sites, calendar sharing settings. Some backup products cover these, most cover only mail, files, calendars and contacts.

Do you need a separate backup? A short test

Answer these honestly for your own company.

  1. Would losing the last three months of one person's email hurt? If the answer is yes for anyone in sales, finance or leadership, that is one point.
  2. Are you required to keep records? Regulated industry, public company or planning to be one, government or enterprise clients with contract terms about records, or any tax authority. One point.
  3. Has anyone ever asked for a file or email that was already gone? One point. It will happen again.
  4. Do people leave and get offboarded in a hurry? If offboarding is done by whoever has time rather than from a checklist, one point.
  5. Would a day without access to your tenant stop the business? One point, and a reason to keep a copy of the data outside the tenant.

Zero or one point: turn on the built-in protections below and revisit in a year. Two or more: add a backup. The service costs a few dollars per user per month, far less than one afternoon of reconstructing a finance folder from attachments.

What to turn on today, backup or not

Microsoft 365

  • Raise the mailbox Recoverable Items window from 14 to 30 days
  • Create a retention policy of at least one year for Exchange, OneDrive, SharePoint and Teams
  • Set OneDrive to keep a deleted user's files for 365 days instead of 30
  • Make leavers' mailboxes inactive or shared before removing the license
  • Require multifactor authentication for everyone, since most data loss starts with a stolen password

Google Workspace

  • Set up Vault retention rules for Mail, Drive and Chat if your plan includes Vault
  • Move team documents from My Drive into shared drives, which survive when the creator leaves
  • Use the transfer option every time a user is deleted
  • Turn on 2-Step Verification enforcement for the whole organization
  • Review the Data Export and Takeout settings so only admins can pull data out

What a good backup looks like

  • Stored outside the tenant. In the backup vendor's own cloud or a storage account you control, so a locked-out tenant does not mean locked-out backups.
  • Automatic and at least daily. Backups that need someone to remember them are not backups.
  • Restores a single item. One email, one file, one version, back to the original place or to a folder, in minutes. Full-tenant restores are rare; single-item restores happen every month.
  • Covers mail, calendars, contacts, OneDrive or Drive, SharePoint or shared drives, and Teams or Chat. Check the list; several products quietly skip Teams or shared drives.
  • Retention you choose. Seven years for finance and legal, one year for everyone else is a common pattern.
  • Tested. Restore one random item every quarter and write down that you did. Auditors ask for exactly this, and so do we.

Microsoft now sells its own backup service for Microsoft 365, billed by the amount of data, and Google partners offer the same for Workspace. Both are fine for a company that wants one vendor. An independent backup service, which we provide and run for our clients, adds the separation from the tenant that is the point of a backup for most companies.

FAQ

Questions people ask

Short answers to what founders and finance leads ask us most.

Ask us something else

Microsoft protects the service against failures on its side and gives you recycle bins, version history and 30 days to restore a deleted account. It does not promise to recover data your company deleted once those windows pass, describes data protection as a shared responsibility, and now sells its own backup service. Retention policies, included in Business Premium, close much of the gap inside the tenant.

Your feedback

Was this guide useful?

How SF3 Technologies helps

We set the retention policies, the recycle bin windows and the offboarding steps in your own Microsoft 365 or Google Workspace, so the built-in protection is as good as it can be. Where a backup makes sense we provide the backup service for your environment, stored outside your tenant, with the retention chosen per team and a quarterly restore test we run with you. Your tenant and your accounts stay yours, managed through dedicated admin access.

Talk to us about backup and retentionMicrosoft 365 management

Retention periods are Microsoft's and Google's published defaults as of October 2026 and can differ in your tenant. Check your own settings before relying on them.