Businesses often assume that email and files stored in Microsoft 365 or Google Workspace are automatically protected against every kind of loss. Cloud providers do protect the services they operate, but that is not the same as having a recovery plan that meets your business’s needs.
Whether you need a separate Microsoft 365 and Google Workspace backup depends on the risks you need to manage, the data you must retain, and how quickly you need to recover it. The practical first step is to identify what matters, then verify exactly what your current tools can restore.
Cloud availability, retention, and backup are different
Availability is about being able to use a cloud service. A provider works to keep its service operating, but service availability does not necessarily mean your organization can recover a particular file, mailbox, or account after it is deleted or changed.
Retention keeps information available according to configured rules or product features. It can support recordkeeping and help recover certain content, but its purpose and recovery options may differ from those of a backup.
Backup creates recoverable copies of data so it can be restored after events such as accidental deletion, unwanted changes, ransomware, or a compromised account. A backup plan should specify what is copied, how long copies are kept, who can access them, and how restoration works.
Microsoft describes cloud security as a shared responsibility, meaning the provider and customer have different responsibilities. That’s why using a hosted service should not be treated as proof that your organization has a complete recovery plan. See Microsoft’s explanation of shared responsibility and verify the protections available for your specific services and plan.
What should a cloud backup cover?
Start with an inventory of the information and settings your business would need to keep working after a loss. Don’t assume that a backup tool covers every service or content type by default. Check its documentation and configuration for each item.
- Email and calendars: Include the mailboxes, calendars, and related information employees need for daily work.
- Personal and shared files: Identify files stored in individual accounts as well as shared folders, team sites, and shared drives.
- Collaboration content: Ask whether messages, shared documents, and other collaboration data are included, and whether the backup preserves useful context and access permissions.
- User accounts and access: Find out whether account information, group membership, permissions, and other settings can be restored or must be recreated.
- Critical configuration: List service settings and business workflows that would be difficult to rebuild. Confirm whether your backup product covers them or whether you need separate documentation.
For Microsoft 365, check the scope for the services your organization uses, including email, calendars, OneDrive, SharePoint, and collaboration content. For Google Workspace, check Gmail, calendars, Drive files, shared drives, and any other business-critical content in use. Coverage varies by product and configuration, so request a clear service-by-service answer.
Google’s guidance says, “Google Drive files moved to Trash remain there for 30 days; after that, they are deleted forever. Emptying Trash deletes them sooner.” Review Google’s explanation of what happens when you delete a Drive file alongside your own recovery needs.
Check how recovery works in real situations
A backup plan should address more than accidental deletion. Ask what happens if a file is overwritten, a mailbox is removed, ransomware changes files, or an administrator account is compromised. Also consider the difference between recovering data and restoring access to the cloud service itself. A backup may help recover information without bringing the provider’s service back online.
For each situation, ask which data can be restored, how far back the available copies go, and where the restored content will appear. Confirm whether recovery preserves folder structure, sharing permissions, and other details that people need to resume work. Microsoft’s Microsoft 365 Backup frequently asked questions can help you understand the scope of that specific offering, but assess your organization’s complete setup rather than relying on a feature name alone.
Protect the backup environment, too. Ask whether backup access is separated from ordinary administrator access, whether access is limited to the people who need it, and what safeguards are available if an account is compromised. A separate cloud-to-cloud backup is not automatically independent: check where copies are stored, how they are accessed, and whether an attacker with access to your primary account could also affect them.
Retention and legal preservation are not interchangeable
Retention tools and archives can be useful, but don’t assume that they provide the same restoration options as a backup. For example, don’t treat Google Vault as a substitute for a recovery plan unless you have verified that it meets your requirements for restoring operational data. Records-management and regulatory needs can also be different from day-to-day recovery needs. Confirm those requirements with qualified counsel or the appropriate compliance professional.
Set retention periods based on your business needs and applicable recordkeeping requirements. Ask how long recoverable copies remain available, whether older copies can be retrieved, and what happens when a user or service account is removed. The right retention approach depends on your organization’s data and obligations.
Make sure your backup can be restored
A backup is useful only if the right information can be recovered in a way your organization can use. Ask your provider or IT team to demonstrate a restore, and include checks such as:
- Can you find and restore a specific email, file, or folder?
- Can you recover content from a shared location as well as an individual account?
- Does restored information retain the permissions and structure employees need?
- Can the restore be completed within the timeframe your business requires?
- Are the steps documented, and do the responsible people know how to follow them?
Test carefully so the exercise does not overwrite current information or interrupt work. Record what was tested, what worked, and what needs attention. Zevonix has experience helping businesses with backup and recovery and business continuity. You can also read how to test business backups without disrupting work for additional planning guidance.
Recovery targets help make the test meaningful: decide how much recent work your organization can afford to lose and how long it can operate without access to the affected data. For more on setting those expectations, see recovery targets for your business.
Choose a backup plan around your needs
Separate SaaS backup is not automatically required for every organization, but built-in service features should not be assumed to cover every recovery, retention, or continuity need. Compare the risks your business faces with the actual coverage, retention, access controls, and restore options in your current setup.
For businesses in St. Augustine and surrounding areas, Zevonix provides IT support and technology services, and its experience includes helping businesses plan for backup, recovery, and continuity. If you are unsure what your Microsoft 365 or Google Workspace setup protects, contact Zevonix to review your recovery requirements and identify what to verify next.