Ransomware-proof backups for Microsoft 365 and Google Workspace
Cloud platforms keep their own services running, but that does not give every business an independent copy of deleted, encrypted or maliciously altered files.
Separate backup from the live administrator account
Use a backup service that stores Microsoft 365 or Google Workspace data outside the live tenant. A compromised cloud administrator must not be able to delete the backup copy with the same account.
Protect the backup console with its own administrator account and multi-factor sign-in. Keep recovery details under company control.
Cover the data staff rely on
Back up mailboxes, shared mailboxes, OneDrive or Google Drive, SharePoint or Shared Drives, calendars and contacts. Check whether Teams chats, Google Sites and other business records need separate coverage.
Do not assume a recycle bin is a backup. Retention periods expire, and synchronised deletion can remove the working copy before anyone notices.
Keep copies that cannot be changed
Set a retention period that keeps earlier versions after deletion or encryption. Where the service supports immutable retention, prevent administrators from shortening it during that period.
Document who can change retention and who reviews failed backup jobs. A warning email sent to an unmonitored mailbox does not protect the copy.
Prove that restoration works
Restore a small sample every month and run a wider exercise each quarter. Test a mailbox, a shared folder and a file version from before a known date.
Record the date, item restored, time taken and any missing permissions or metadata. Fix failed restores while the live service is still available.
Common questions
- Does Microsoft 365 back up our data?
- Microsoft protects the platform and provides retention features, but a business still needs to decide how it will recover data after accidental deletion, a compromised administrator or retention expiry. A separate backup gives the business an independently controlled copy.
- Is Google Drive version history enough?
- No. Version history and bins help with ordinary mistakes, but they have limits and remain inside the same account boundary. An independent backup protects against account compromise and expired retention.
- How often should cloud backups run?
- For active email and files, several backups each day are common. The right interval depends on how much work the business can afford to lose. Restore testing matters as much as the schedule.
Official UK sources checked
Related UK cybersecurity guides
Is OneDrive a backup? Why sync and recycle bins fall short
OneDrive and Google Drive keep files available across devices, but sync, recycle bins and version history do not amount to an independent backup. This guide explains how deletions spread, where retention runs out, what a compromised administrator account can destroy, and how to build a protected copy you have actually tested.
How to Switch On MFA for Every Microsoft 365 User in a Small Business
For most businesses with 5 to 50 staff, the quickest route to MFA for every Microsoft 365 user is Security Defaults in the Microsoft Entra admin centre. This guide gives the admin path, the checks to run before enabling it, when Conditional Access is the better fit, and the accounts that deserve extra attention.
How to Enforce 2-Step Verification in Google Workspace
Enforcing 2-Step Verification in Google Workspace is done from the Admin console under Security, Authentication. This guide covers the admin path, choosing an organisational unit or group, staging the rollout so staff can enrol, protecting administrator accounts first, and handling recovery codes and lost devices before enforcement begins.