Microsoft 365 and Google Workspace are handy platforms but there’s a common misconception that catches a lot of organisations out:
“Our data is in Microsoft/Google, so it must be backed up.”
In reality, both vendors operate under a Shared Responsibility model. They keep the service running (the platform), but you’re responsible for protecting your data inside it: emails, files, Teams/Chat messages, calendars, Sharepoint/Onedrive content, and more.
“But surely Microsoft/Google can just restore it?”
Sometimes they can help with limited scenarios. Often, it’s not that simple.
These platforms serve millions of customers, which means any single tenant (even a large one) is a tiny fraction of the overall ecosystem. If something goes wrong, it can be hard to get fast, personalised support from someone who understands your environment and can execute a clean recovery.
And big incidents do happen. In 2024, UniSuper suffered a major event where their Google tenancy was wiped due to a software issue on Google’s side. It’s a stark reminder that even hyperscale providers aren’t immune to mistakes or outages.
Accidental deletion, sync issues, and “oops” moments
Most real-world data loss isn’t a movie-style cyber attack, it’s everyday stuff:
- A user deletes the wrong folder (then empties the Recycle Bin)
- A departing staff member’s account gets removed before data is handed over
- A sync tool or migration script overwrites content
- Retention policies are misconfigured
- Ransomware encrypts files and the encrypted versions sync back into the platform
Native retention and recycling features help, but they’re not the same as a true backup; especially when you need a clean point-in-time restore, long-term retention, or an immutable copy.
Moving away? You can’t “archive and cancel” without a backup
Another practical issue: your data lives behind an active subscription.
If you ever decide to move away from Microsoft 365 or Google Workspace, you usually need to keep paying until that migration is complete because once your subscription is cancelled, access to the data is gone.
If you want a historical, immutable archive that you can keep independently (for compliance, legal, or simply peace of mind), you can’t really do that without taking a separate backup.
AI is making data changes faster (and riskier)
We’re also entering an era where automation and “agentic AI” are doing more work inside these platforms including creating, modifying, moving, and deleting content.
That’s powerful, but it also raises the stakes:
- Autonomous actions can be incorrect
- Changes can happen at scale, very quickly
- It can be hard to unwind “what changed” after the fact
Here are a few examples that highlight the direction things are heading:
- AI agent wipes production data (and backups)
- Unintended AI behaviour affecting data
- Agent escalates privileges and overwrites system config without approval
When the source system is changing rapidly, having a separate, isolated backup becomes even more important.
The simplest way to think about it: avoid a single copy of your data
If all your data lives only in Microsoft 365 or Google Workspace, you effectively have one ledger.
Backups give you a second, independent copy; something you can verify, retain long term, and restore from when (not if) something goes wrong.
What a good Microsoft 365 / Google Workspace backup should do
When evaluating options, look for:
- Granular recovery (single emails/files, not only whole accounts)
- Immutable, ransomware resilient backups (resistant to tampering/deletion/encryption)
- Independent, sovereign storage (separate from the SaaS platform)
- Clear reporting and regular testing (so you know it’ll work when needed)
- Access to data backup specialists (restores can be complex. It helps to speak directly with people who understand your environment and can guide a clean recovery)
Want a second opinion on your backups?
If you want a second opinion, we’re available to sanity-check your current retention and backup setup, call out any gaps, and show you what a proper backup looks like in practice, even if you already have something in place.