If my data is in Microsoft 365, isn't it already backed up automatically?

No. Microsoft keeps replicas (replication) to keep the service available, but that isn't a backup. If a file is deleted or encrypted by ransomware, replication simply replicates the deletion or the encryption. It doesn't restore an earlier, healthy version.

What's the difference between the Recycle Bin and a real backup?

The Recycle Bin lives in the same tenant. If the account is breached, the file is accidentally deleted permanently, or the retention period (30-93 days, depending on the service) has passed, the file is gone. A real backup is an independent, isolated copy that survives even if something happens to the original account.

How long does Microsoft 365 keep deleted files?

It varies by service. In email (Exchange), deleted items are removed after about 30 days, in Teams after about 30 days, and in OneDrive/SharePoint after up to 93 days. After that, there's no way to recover them without an external backup.

Does this apply to Google Workspace too?

Yes, just as much. In Gmail, Drive and Google Workspace, the company is responsible for the infrastructure and availability, but actually backing up the data is the business's responsibility.

What happens if an employee accidentally clicks a ransomware link and encrypts a shared folder?

Without an isolated, independent backup, the encryption will sync to everyone who shares the folder, and there's no 'previous version' to go back to beyond the short window the service itself retains. That's exactly the scenario an external backup is meant for.

Does Microsoft 365 Back Up Your Data? The Answer Most Businesses Don’t Know

“It’s in the cloud, so it’s definitely backed up.” That’s one of the most common assumptions we hear from business owners, and also one of the most dangerous. The short answer: no. Microsoft runs the infrastructure behind Exchange, SharePoint, Teams and OneDrive and makes sure the service stays available, but keeping your data, and being able to restore it, is your responsibility.

This is called the Shared Responsibility Model, and all the major backup vendors (Veeam, Keepit, AvePoint) agree on this division. So does Microsoft itself. (More on how we manage cloud solutions is available on the dedicated page.)

What Microsoft Actually Keeps, and for How Long

Microsoft 365 services have replication mechanisms and a limited retention period for deletions, but not a backup in the usual sense:

Exchange (email): deleted items stay recoverable for only about 30 days
Teams: chats and team files are kept for about 30 days after deletion
OneDrive / SharePoint: up to about 93 days, depending on settings

Beyond that time window, the file is gone. And that’s before we get to the more common case: ransomware that encrypts a shared folder. Microsoft’s replication can’t “tell” a healthy version from an encrypted one. It simply replicates whatever happened.

Why the Recycle Bin Isn’t a Backup

The key difference: the Recycle Bin and replication live in the same tenant, meaning the same account and the same infrastructure. A real backup is an independent, isolated copy that keeps existing even if:

The account itself is breached or disabled
Someone (intentionally or by mistake) permanently deleted content
Ransomware encrypted files at the user or sharing level

“It only helps if you did something wrong in the tenant” is exactly the difference between replication and backup.

Microsoft Itself Recommends an External Backup

This isn’t just the opinion of backup companies. It’s written in Microsoft’s own services agreement: the company explicitly recommends using third-party backup tools for data stored in Microsoft 365. In other words, even the company that runs the service doesn’t present its built-in redundancy as a substitute for backup.

The same is true for Google Workspace. There too, Google is responsible for the infrastructure, and you’re responsible for the actual backup.

What You Should Actually Check in Your Business

Check whether you have a dedicated backup solution for Microsoft 365 / Google Workspace, not just what the service itself offers.
Check your recovery window. If a file was deleted 4 months ago, do you have a way to restore it?
Check the ransomware scenario. If a shared folder gets encrypted today, how quickly can you get back to a healthy version?
Tie it to your overall backup. This connects directly to the 3-2-1 rule we wrote about in our guide Why Backups Matter for Your Business. A Microsoft 365 cloud copy doesn’t count as a “second copy” if it’s the only one you have.

When You Need Professional Help

If you’re not sure what retention policy you have today in Microsoft 365 or Google Workspace, or you’ve never actually tested a restore, now is the time to check, not after something happens. Setting up a dedicated backup for your office suite is a small addition to infrastructure you already have, not a big project.

Summary

“It’s in the cloud” and “it’s backed up” are two different claims. Microsoft and Google make sure the service is available, but actually keeping your data, including recovering from ransomware or deletion, is your responsibility. Better to find that out now than on the day you need to restore something that no longer exists.

Want to check exactly what’s backed up for you today in Microsoft 365 or Google Workspace? Contact us for a short, free review.

Does Microsoft 365 Back Up Your Data? The Answer Most Businesses Don't Know - Rtek