M365 & Google Workspace Backup: Do You Need It? Costs (2026)

Even with cloud services such as Microsoft 365 and Google Workspace, a third-party backup is worth having whenever you hold important data. The service provider guarantees that the service keeps running (availability). Restoring data that users deleted by mistake, that disappeared with a departed employee's account, that was encrypted by ransomware and synced, or that was wiped after an account takeover is, in principle, the customer's responsibility. This is called the shared responsibility model. The built-in recycle bins and retention periods are enough in many cases, but once the period expires the data cannot be recovered. As a rough guide, third-party SaaS backup (backup built specifically for cloud services) typically costs from a few hundred yen to the low thousands of yen per user per month: a few thousand to the low tens of thousands of yen per month for 10 people, and tens of thousands of yen for 50 people (this varies by plan and contract). This article, written for companies without a dedicated IT person, covers what the built-in features can and cannot do, a comparison of options, what to back up, how to decide retention, cost examples by company size, a selection checklist, restore tests, handling departed employees' accounts, and common mistakes.

For company-wide data protection, see Business Data Backup Methods and Costs; for disaster recovery planning, see Cloud Backup and DR; and for plan selection, see Reviewing Your Microsoft 365 Plan. This article complements them and focuses on the data inside the cloud.

The idea that data is safe because it is in the cloud is only half right. Losing data because a large provider's servers broke is very rare. But data lost through user actions or attacks happens routinely. Here are four typical cases.

- Accidental deletion or overwriting: deleting a whole shared folder, or saving an old file over a new one. If you notice late, the recycle bin retention period may already have passed
- Deleting a departed employee's account: after an account is deleted, its mailbox and personal drive are eventually removed too. Deleting before handover is a common accident
- Ransomware syncing: files encrypted on a PC are reflected in the cloud by the sync feature. The cloud itself is fine, but its contents are replaced with damaged data
- Account takeover: an attacker with a stolen password may delete large amounts of mail and files or forward them outside. If an administrator account is taken over, the damage reaches the whole company

What these have in common is that data can disappear even while the service is working normally. A cloud service guarantees that it keeps running; it does not guarantee to restore what users have deleted.

The shared responsibility model divides cloud security between the provider and the customer. The provider protects the data centers, servers and the running of the software. The customer decides who gets which permissions, which data to keep, and how to restore it when it is lost. Think of a building management company: it maintains the building and equipment, but is not responsible if someone throws away documents inside your office. Both Microsoft and Google explain the customer's data responsibilities in their official terms and guidance. Always check the exact conditions of your own plan.

First, understand the built-in features that cost nothing extra. The periods below are widely cited guidelines and may differ by plan, administrator settings and over time.

- OneDrive and SharePoint recycle bins: deleted files go to the recycle bin and can generally be restored for about 93 days in total. Handling changes if the bin is emptied or an administrator deletes the items
- Exchange (mail) deleted items: deleted mail can be recovered for a limited period. The default is fairly short, and administrators may be able to extend it
- Google Drive trash and Gmail trash: items are generally deleted permanently after about 30 days
- Version history: lets you return to earlier versions of a file. However, the number and period of saved versions are limited, and it is not suited to restoring a whole folder or everyone's files at once
- Microsoft Purview retention policies and Google Vault: features for keeping data for a set period for legal or audit purposes. Availability depends on the plan

A common misunderstanding is that retention policies and Google Vault are features for preserving evidence, not for restoring business operations quickly. Even if the data is retained, rolling everything back to a specific point in time is difficult, and even searching for and extracting it takes effort. Compliance features and backup have different purposes.

The built-in features have three limits. The first is time: after 30 or 93 days, data generally cannot be restored. The second is scope: restoring one file is easy, but returning thousands of files to yesterday morning's state is hard. The third is an attacker with administrator rights: if the recycle bins are deleted too, the built-in features cannot fully protect you.

Microsoft itself offers a paid feature called Microsoft 365 Backup. It targets SharePoint, OneDrive and Exchange and aims to restore quickly to a specific point in time, and it is billed by capacity, meaning the amount of data protected. Unit prices and coverage can change, so always check the latest pricing in Microsoft's official information. For companies centered on Microsoft 365, its advantage is that everything can be handled from the same admin console. On the other hand, it cannot be used for other services such as Google Workspace. Because cost depends on data volume rather than the number of users, companies with a lot of files should estimate in advance whether costs will exceed expectations.

SaaS backup is a dedicated service that regularly copies Microsoft 365 or Google Workspace data to a separate storage location outside the service. You can think of it as a cloud that protects the contents of another cloud. It comes in three main forms.

- Per-user dedicated services: billed monthly per user. They take copies automatically and let you restore from an admin console. They are the most affordable for small and medium businesses
- Capacity-based enterprise backup products: billed by the amount of data stored. Suitable for large volumes of data or when you want to protect other systems together. Setup often requires specialist knowledge
- Managed services from resellers and maintenance companies: configuration, monitoring and even restore work are handled for you. Monthly fees are higher, but you can operate without in-house expertise

As a general guide, per-user services often fall between a few hundred yen and the low thousands of yen per user per month. However, some pricing plans raise the unit price as you add targets such as mail, drives and chat, and exchange rates and revisions also have an effect, so always confirm with a quote.

Trying to protect everything inflates costs, so first sort out the targets. Prioritize the following five, starting with those whose loss would hurt most.

- Mail: exchanges with business partners serve as evidence for contracts and payments. The loss that most people would regret
- OneDrive and Google Drive (personal files): each employee's working data. Consider how to handle departed employees' data as well
- SharePoint and shared drives (department files): the core of the company's business files. High priority
- Teams and chat: conversation history. It records the background of business decisions, but some products do not back it up. Check what each product supports
- Calendars and contacts: light data, but without it you lose track of schedules and partner information

Note that Teams chats and files are stored behind the scenes in mailboxes and SharePoint. Depending on the product, they may or may not be protected as part of mail or SharePoint backup. Even if a product says chat can be restored, always check how far it can be restored.

When choosing a backup, deciding two time values avoids confusion. RPO (recovery point objective) is how far back in time you can accept losing data. If one day old is acceptable, one backup a day is enough. RTO (recovery time objective) is how many hours after an outage you want to be working again. Discuss within the company whether you can tolerate mail being down for half a day or cannot stop even for an hour.

Retention, meaning how many days or months of past versions to keep, depends on how late you are likely to notice a problem. Accidental deletions are often noticed within days, but departed employees' data and quiet tampering may be found months later. Many small and medium businesses think in a range from 30 days to one year. Longer retention increases storage and cost, so a product that allows different settings, such as longer for mail and shorter for temporary working files, is convenient. For data whose retention period is set by law or by contracts with customers, use that period as the minimum.

Here are the five options compared. Costs are general guides; actual amounts depend on the contract.

Manual export works as a supplement if you extract only the most important data once a year to an in-house NAS or similar. But if you rely on it as the main method, it stops when the person in charge gets busy, and you often discover months of gaps later. The main method should be an automated mechanism.

Below is a rough guide when introducing third-party SaaS backup at a few hundred yen to the low thousands of yen per user per month (excluding tax and initial setup; actual amounts depend on the product and contract).

Some products also charge for targets without licenses, such as departed employees and shared mailboxes. When getting quotes, confirm not only the user count but also how billable targets are counted. If you review licenses at the same time, the savings may cover the backup cost.

When comparing products, check the following in addition to price.

- Does it support the services you use (Microsoft 365, Google Workspace, or both)?
- Of mail, drives, shared files, chat and calendars, how much is covered?
- How many times a day is backup taken (can it meet your RPO)?
- What units can be restored (file, folder, mailbox, or everything)?
- Can it restore other people's data and data from deleted accounts?
- Do the storage region (country or area) and encryption method meet your policies and customers' requirements?
- Can administrator sign-in use multi-factor authentication? A hijacked backup console defeats the purpose
- Can you take your data out after canceling?
- Is Japanese-language support available if you need help with a restore?

A backup only has value if you can restore from it. Many companies sign up, feel reassured, and never restore anything. Run a restore test right after introduction and then once or twice a year, as follows.

- Prepare a test folder and test mail, and delete them on purpose
- Restore them to their pre-deletion state from the backup product
- Record how long it takes and which operations are needed
- Check whether you can restore to the original location or only to another one
- Write a procedure document that people other than the person in charge can read

The purpose of the test is not just to confirm success. It is to find weaknesses before an incident, such as a procedure that is too hard or permissions that are too limited to restore. A real restore happens under pressure, so having a procedure document makes a large difference.

Mail and files do not vanish the instant you delete a departed employee's account, but they are eventually lost after a set period. Take the following steps before deleting. The full flow is in the IT offboarding checklist.

- Move business-critical mail and files to a successor or a shared location
- Decide whether to simply remove the license and keep the account, or delete the whole account. In some settings, removing a license can cause data loss, so read the admin console explanation beforehand
- For addresses that keep receiving inquiries from partners, consider forwarding or switching to a shared mailbox
- Check that the backup product is set to keep the data for a period even after deletion

If you keep a departed employee's data for a long time, it is often cheaper to store it in the backup product and tidy up the account than to leave a licensed account idle. However, for data containing personal information, decide the retention period and who may view it.

- Treating sync as backup: sync spreads deletions too. Without a separate copy, it is not a backup
- Signing up but not setting targets: new SharePoint sites created after introduction or new hires may not be included automatically. Review targets regularly
- Never testing a restore: when you actually try, you lose time to missing permissions or unknown procedures
- Having only one administrator: if that person's account is hijacked or they leave, no one can operate it
- Weak authentication on the backup side: if the backup console is protected only by a password, an attacker may delete it first
- Growing capacity or retention later and inflating costs: set a forecast for retention and data volume at the start

- Confirmed our Microsoft 365 / Google Workspace plan and its built-in retention periods
- Prioritized targets (mail, drives, shared files, chat, calendars)
- Decided RPO, RTO and retention within the company
- Compared three options by quotes: built-in only, Microsoft 365 Backup, third-party service
- Enabled multi-factor authentication on the backup product's administrators
- Appointed at least two administrators
- Ran a restore test right after introduction and wrote a procedure document
- Added a backup check to the offboarding process
- Set a date once or twice a year for restore tests and target review