# Email archiving vs backup: what's the difference, and do you need both?

URL: https://iblockspam.com/blog/email-archiving-vs-backup
Last updated: 2026-10-12
Published: 2026-10-12
Topic: Running email day to day
Author: iBlockSpam Team

> Email archiving keeps searchable records for compliance; backup restores mailboxes after deletion or ransomware. What Microsoft 365 and Google Workspace offer.

## Short answer

Email archiving keeps a searchable, tamper-resistant copy of messages for a set period so you can meet retention rules and find mail for audits or lawsuits. Email backup keeps point-in-time copies so you can restore mailboxes after deletion, corruption or ransomware. Archives find; backups restore. Most businesses need retention plus a tested restore path.

Archiving and backup both keep copies of your email, so they're easy to confuse. They answer different questions. An archive answers "can we find and prove what was said?" A backup answers "can we get our mailboxes back after something goes wrong?" This guide compares the two, shows what Microsoft 365 and Google Workspace include, and helps you decide what you need.

## What is the difference between email archiving and backup?

Email archiving is keeping a searchable, preserved copy of messages for a defined retention period, so you can meet legal and regulatory duties and find mail for audits, disputes or investigations. Email backup is taking regular point-in-time copies of mailboxes so you can restore them after accidental deletion, corruption, account compromise or ransomware.

| | Email archiving | Email backup |
|---|---|---|
| Main purpose | Compliance, retention and eDiscovery | Recovery and business continuity |
| Question it answers | "Find every message about X from 2023" | "Put this mailbox back as it was last Tuesday" |
| Typical contents | Individual messages, kept unchanged under a retention rule | Snapshots of whole mailboxes, folders and settings |
| How you get data out | Search and export | Restore to the mailbox, in place or to a new folder |
| Retention period | Years, set by your [retention policy](https://iblockspam.com/blog/email-retention-policy-small-business) | Weeks to a few years of restore points |
| Who uses it | Compliance, legal, management | IT, after an incident |
| Main risk if you lack it | Can't produce required records | Can't recover from deletion or ransomware |

Some products do both, but you should check each capability separately.

## What does Microsoft 365 include for archiving and backup?

Microsoft 365 gives every Exchange Online mailbox deleted-item recovery, offers archive mailboxes and retention policies on many plans, and sells Microsoft 365 Backup as a separate pay-as-you-go service. At the time of writing (October 2026), which features you get depends on your plan, so check Microsoft's service descriptions.

- **Deleted item recovery.** Microsoft says the default deleted item retention period "is 14 days", adjustable "up to a maximum of 30 days". After that, "the item is removed from Exchange Online" unless a hold or retention policy keeps it ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/security-and-compliance/recoverable-items-folder/recoverable-items-folder)).
- **Archive mailboxes.** An [archive mailbox](https://learn.microsoft.com/en-us/purview/archive-mailboxes) is an extra mailbox for more storage. By default, Microsoft's retention policy "moves items that are two years or older" from the primary mailbox to the archive. Users can move and delete items there. It's storage, not a separate protected copy.
- **Retention policies and holds.** [Microsoft Purview retention](https://learn.microsoft.com/en-us/purview/retention) keeps mail for a set period even when users delete it. This is archiving in the compliance sense.
- **Microsoft 365 Backup.** A [separate pay-as-you-go service](https://learn.microsoft.com/en-us/microsoft-365/backup/backup-overview) that takes restore points for Exchange mailboxes, OneDrive and SharePoint. For Exchange, Microsoft lists restore points every "10 minutes for prior 52 weeks" and a recovery window you can set to 3 months, 6 months, 1 year or 2 years. Microsoft notes that Purview retention and deletion policies "don't affect the backup recovery window", which keeps the two jobs separate.

## What does Google Workspace include for archiving and backup?

Google Workspace includes Trash and admin restore windows, and Google Vault for retention, holds and eDiscovery. Google doesn't present Vault as a backup.

- **Trash and admin restore.** Users can recover their own deleted mail from Trash for 30 days. After that, Google gives admins "an additional 25 days" to restore it with the Restore data tool. Once that window closes, Google says messages "can't be restored by an admin or by Google" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/support/troubleshooting/restore-a-users-permanently-deleted-email)).
- **Google Vault.** Vault keeps mail under retention rules and holds and lets you search and export it. Google's [Vault FAQ](https://knowledge.workspace.google.com/vault/getting-started/google-vault-faq) is direct: "Vault isn't designed to be a backup or archive tool." Google also says "restoring data from Vault export files is hard" and that Vault "doesn't have any automated recovery tools".

If you need to roll a Google Workspace mailbox back to an earlier state, you'll need a separate backup service. Check what a provider can restore, how fast, and where it stores the copies.

## Which one protects you in each scenario?

Archiving and backup protect against different failures. Use this table to see where your gaps are:

| Scenario | Native recycle window | Archive or retention | Backup |
|---|---|---|---|
| User deletes an email last week | Usually yes | Yes, if covered by a rule | Yes |
| User deleted a folder three months ago | No | Yes, can search and export | Yes, if within recovery window |
| Lawyer asks for all mail about a contract from 2022 | No | Yes | Rarely practical |
| Mailbox full | No | Archive mailbox adds space | No |
| Attacker in a [compromised account](https://iblockspam.com/blog/signs-email-account-compromised) deletes or alters mail | Partly | Yes, if a retention policy or hold covers the mailbox | Yes, restore to a point before the attack |
| Ransomware encrypts files synced from mail attachments | No | No | Yes, if backups are isolated |
| Employee leaves and their account is deleted | Short window only | Yes, if retained first | Yes |
| You lose access to the whole tenant or account | No | No | Only if stored outside it |

The last row matters. A backup stored inside the same account and admin system is exposed to the same compromised admin password.

## What does CISA recommend for backups?

CISA's [#StopRansomware Guide](https://www.cisa.gov/resources-tools/resources/stopransomware-guide) recommends that you "maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario". It warns that automated cloud backups may not be enough, because if local files are encrypted, "these files will be synced to the cloud, possibly overwriting unaffected data."

For email, that translates into three questions for any backup you rely on:

1. **Is it separate?** Different credentials, ideally a different provider or an immutable store, so one stolen admin account can't delete both.
2. **Is it versioned?** You need restore points from before the incident, not just the latest copy.
3. **Have you tested a restore?** An untested backup is a guess.

Email is also how most ransomware gets in. Our [ransomware email delivery guide](https://iblockspam.com/blog/ransomware-email-delivery-prevention) covers prevention.

## Do I need both email archiving and backup?

Most businesses need both functions, though not always two products. You need archiving or retention if you have legal, tax, industry or contractual duties to keep email. You need backup if losing a mailbox, or a week of mail, would hurt the business. That describes almost everyone.

Use this checklist to decide:

1. **List your retention duties** and periods. The [email retention policy guide](https://iblockspam.com/blog/email-retention-policy-small-business) shows how.
2. **Check what your plan already includes**: retention policies or Vault, archive mailboxes, holds.
3. **Set your recovery targets**: how far back you must be able to restore, and how fast.
4. **Compare native recovery windows** (14 to 30 days in Exchange Online, Trash plus 25 days in Google Workspace) against those targets.
5. **Choose a backup** that is separate from your production admin accounts, if native tools don't meet your targets.
6. **Protect admin accounts** with phishing-resistant MFA; a backup is only as safe as the login that can delete it.
7. **Test a restore** of one mailbox now, and repeat on a schedule.
8. **Write it down** in your [incident response plan](https://iblockspam.com/blog/email-security-incident-response-plan).

## What should I ask an archive or backup provider?

Ask an archive or backup provider how it handles the failures you care about, not just how much it stores. These questions separate real capabilities from marketing:

| Question | Why it matters |
|---|---|
| What exactly is captured: mail, calendar, contacts, shared mailboxes, archive mailboxes? | Gaps often appear in shared and archive mailboxes |
| How often are restore points taken, and how far back do they go? | Sets the most data you could lose |
| Can you restore one message, one folder and a whole mailbox, in place or to a new location? | Different incidents need different restores |
| Where are copies stored, and are they separate from the production account? | A copy behind the same admin login shares its risk |
| Can an admin delete backups or archived items, and is there a grace period or alert? | Attackers target backups first |
| Can archived items be changed, and is access logged? | Matters for proving records are unaltered |
| How is data exported if you leave? | You may need old records long after you switch |
| Which country is data stored in? | May matter for contracts and data protection rules |

Microsoft's own backup service is a useful benchmark. It uses append-only storage, and Microsoft says Exchange backup copies, once created, "aren't modifiable by the service". It also keeps a 90-day grace period to recover backups after offboarding, and can alert a group of admins when a potentially harmful action is taken. Whatever you choose, ask for the equivalent answers in writing.

## Is my spam filter an archive or a backup?

No. A spam filter's logs and quarantine are built for delivery troubleshooting and short-term recovery of blocked mail, not records. iBlockSpam, for example, keeps message history for 30 days and can hold inbound mail for up to 5 days while your mail server is down, through [outage spooling](https://iblockspam.com/features/outage-spooling). That protects mail in transit during an outage. It doesn't replace retention or backup of mail already in your mailboxes. See [what happens to email when your server is down](https://iblockspam.com/blog/what-happens-to-email-when-server-is-down) and [what email quarantine is](https://iblockspam.com/blog/what-is-email-quarantine).

## Next steps

- Find out today how long your platform keeps deleted mail, and whether any retention policy or Vault rule is on.
- Write or update your [retention schedule](https://iblockspam.com/blog/email-retention-policy-small-business) before buying any archive.
- Run a test restore of one mailbox and time it.
- Check that every admin account uses MFA and isn't used for daily email, then review the rest of your [email security checklist](https://iblockspam.com/blog/email-security-checklist-small-business).

## Frequently asked questions

### Is Google Vault a backup?

No. Google's own Vault FAQ answers "Is Vault a data backup or archive tool?" with "No. Vault isn't designed to be a backup or archive tool." Vault retains, holds, searches and exports data for compliance and eDiscovery. Google also says restoring data from Vault export files "is hard" and that Vault has no automated recovery tools.

### Is the Microsoft 365 online archive mailbox a backup?

No. An archive mailbox is extra storage inside the same account. Items are moved there by policy or by users, who can also delete them. It's useful for mailbox size and retention, but a deletion, compromise or bad sync can affect it just like the primary mailbox.

### How long can I recover deleted email without a backup?

Briefly. In Exchange Online, Microsoft says deleted items stay recoverable for 14 days by default, adjustable to 30. In Google Workspace, users have 30 days in Trash, then admins have 25 more days to restore. After those windows, mail is gone unless a retention policy, hold or separate backup kept it.

### Does email archiving help with ransomware recovery?

Only partly. An archive or retention policy may let you search and export old messages, but it isn't built to restore whole mailboxes quickly to a known good point. CISA recommends offline, encrypted backups of critical data that you test regularly, because attackers try to find and delete or encrypt backups they can reach.

### Can my spam filter's message history replace an email archive?

No. A filter's message log is for troubleshooting delivery and usually covers a short window; iBlockSpam's message history, for example, covers 30 days. It also only sees mail that passed through the filter, not internal mail or messages users sent. Use your mailbox platform's retention tools or a dedicated archive for records.

## Sources

- [Google Vault Help: Google Vault FAQ](https://knowledge.workspace.google.com/vault/getting-started/google-vault-faq)
- [Google Workspace Admin Help: Restore a user's permanently deleted email](https://knowledge.workspace.google.com/admin/support/troubleshooting/restore-a-users-permanently-deleted-email)
- [Microsoft Learn: Overview of Microsoft 365 Backup](https://learn.microsoft.com/en-us/microsoft-365/backup/backup-overview)
- [Microsoft Learn: Learn about archive mailboxes](https://learn.microsoft.com/en-us/purview/archive-mailboxes)
- [Microsoft Learn: Recoverable Items folder in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/recoverable-items-folder/recoverable-items-folder)
- [CISA: #StopRansomware Guide](https://www.cisa.gov/resources-tools/resources/stopransomware-guide)
- [Microsoft Learn: Learn about retention policies and retention labels](https://learn.microsoft.com/en-us/purview/retention)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-archiving-vs-backup (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt