Business IT, AI, & Cybersecurity Blog | Four Winds IT

Cloud Storage vs. Cloud Backup: Know the Difference

Written by Dylan Borden | Jan 27, 2025, 5:02:00 PM

Cloud storage like OneDrive, SharePoint or Dropbox keeps your files available and in sync. Cloud backup keeps separate, protected copies you can restore after a deletion, a ransomware attack or a bad sync. Storage is not backup: if a file is deleted, overwritten or encrypted in OneDrive, that change syncs everywhere, and Microsoft's recycle bins only hold deleted files for a limited time.

The dirty secret of IT support is how many businesses find this out the hard way. "It's all in the cloud" feels safe until someone deletes a client folder in March and nobody notices until July, or ransomware encrypts a laptop and OneDrive faithfully syncs the encrypted files.

Key takeaways

  • Cloud storage is built for access and sharing. Cloud backup is built for recovery. You need both.
  • Deleted files in SharePoint and OneDrive are kept for 93 days. Permanently deleted email is kept for 14 days by default, 30 at most.
  • Attackers go after backups first. Good backups are stored separately, can't be changed or deleted by an attacker, and are protected with MFA.
  • A backup you've never restored from is a guess. Test restores on a schedule.

What's the difference between cloud storage and cloud backup?

Cloud storage is where your team works: OneDrive, SharePoint, Google Drive, Dropbox. Files sync across devices and are easy to share. That's exactly the problem during a disaster: every change syncs, including the bad ones.

Cloud backup takes point-in-time copies of your data and stores them somewhere separate. If today's version is deleted, corrupted or encrypted, you restore yesterday's, last week's or last month's. The backup doesn't change when your live files do.

Doesn't Microsoft 365 already back up my data?

Microsoft keeps its service running and gives you recycle bins, but those are designed for quick undo, not long-term recovery:

  • SharePoint and OneDrive: deleted items are retained for 93 days across both recycle bins, then permanently deleted. Microsoft keeps backups for 14 more days, but it can only restore entire sites from those, not individual files.
  • Exchange Online email: permanently deleted items are kept for 14 days by default. An admin can raise that to a maximum of 30.

If nobody notices a problem inside those windows, the data is gone. Microsoft sells a separate Microsoft 365 Backup product for exactly this reason. We back up Microsoft 365 for our clients so email, OneDrive, SharePoint and Teams data can be restored long after the recycle bin has emptied.

The same goes for other cloud apps. Intuit doesn't back up your QuickBooks Online data for you either.

How do you protect backups from ransomware?

Microsoft's own ransomware guidance is blunt: attackers "invest heavily in neutralizing backup applications," and backups they can reach "can be rendered unusable." Protecting the backup matters as much as having one:

  • Follow the 3-2-1 rule. Microsoft recommends 3 copies of your data (the original plus 2 backups), on 2 types of storage, with 1 kept offsite or offline.
  • Use immutable or offline copies. Immutable backups can't be changed or deleted for a set period, even by an admin account an attacker has stolen.
  • Lock down the backup console. Require MFA to change or delete backups, and keep backup credentials separate from everyday admin accounts.
  • Back up more than files. Servers, line-of-business databases and the settings needed to rebuild matter too.

How often should you test your backups?

At least quarterly, and after any major change. A backup job that says "success" only proves the job ran. A test restore proves you can get a real file back, and tells you how long a full recovery would take. Microsoft recommends regularly practicing your recovery plan, including recovering "from zero" when every system is down.

This is how we've kept a 100% ransomware recovery rate: we've never failed to restore a client from a ransomware attack. It's also what kept the Women's Resource Center working through the 2025 storms.

What should a small business back up?

  • Microsoft 365 or Google Workspace: email, OneDrive, SharePoint and Teams.
  • Servers and any on-site file shares.
  • Line-of-business applications and their databases, such as practice management, accounting or ERP systems.
  • Cloud apps that don't back up your data for you, like QuickBooks Online.
  • Critical laptops for people who keep work locally.

Backup is part of the "Secured" foundation of our cybersecurity framework, alongside a business-grade firewall, MFA, endpoint protection and email security. See how our backup and disaster recovery works, or take our cybersecurity tier quiz.

Frequently asked questions

Is OneDrive a backup?

No. OneDrive is cloud storage that syncs your files. If a file is deleted, overwritten or encrypted, that change syncs too. Deleted files stay in the recycle bin for 93 days, and then they're gone. A separate backup keeps independent copies you can restore long after that.

How long does Microsoft keep deleted files and email?

SharePoint and OneDrive keep deleted items for 93 days. Exchange Online keeps permanently deleted email for 14 days by default, and an admin can extend that to 30 days. After that, Microsoft can't restore them.

What is the 3-2-1 backup rule?

Keep 3 copies of your data (the original plus 2 backups), on 2 different types of storage, with 1 copy offsite or offline. Microsoft recommends it as part of its ransomware protection guidance.

Can ransomware encrypt my backups?

It can if the backups are reachable from your network with the same credentials. That's why backups should be immutable or offline, stored separately, and protected with MFA so an attacker with a stolen admin account can't delete them.

How often should backups run?

Most businesses back up key systems at least daily, and more often for data that changes constantly. The right answer depends on how much work you can afford to redo, so we set it system by system.

How do I know my backups actually work?

Test restores. Pick real files and systems, restore them on a schedule and time how long it takes. A backup that has never been restored is a guess, not a plan.

Want to know if your backups would actually save you?

We get it. Backups are invisible until the day you need them. We'll look at what you're backing up today, what's missing and how fast you could really recover, with local engineers in Sarasota and same-day on-site help when you need it. Talk to our team.

Sources