Is OneDrive a Backup? (No — Here's Why)

The short answer: no, OneDrive is not a backup. It's a file sync and storage service. There's a meaningful difference, and misunderstanding it is one of the most common (and most dangerous) mistakes small businesses make with their data.

What OneDrive Actually Does

OneDrive is Microsoft's cloud storage and file sync service, included with Microsoft 365. Here's what it does well:

• Syncs files between your computer and the cloud, so you can access them from anywhere
• Version history — lets you restore previous versions of individual files (up to 30 days, or 500 versions, depending on your licence)
• Recycle bin — deleted files sit in the recycle bin for up to 93 days before permanent deletion
• Collaboration — lets multiple people work on the same document simultaneously
• Files On-Demand — shows cloud files in File Explorer without downloading them until you open them

All of that is genuinely useful. None of it is backup.

Sync Is Not Backup: The Critical Difference

Sync means that changes on one side are replicated to the other side. If you edit a file on your laptop, the change appears in the cloud. If you delete a file on your laptop, it's deleted in the cloud. If ransomware encrypts files on your laptop, those encrypted files sync to the cloud.

Backup means an independent copy of your data, stored separately, that isn't affected by what happens to the original. If ransomware encrypts your laptop and your OneDrive, a proper backup still has a clean copy from before the attack.

The key word is independent. A backup is not connected to, synced with, or affected by the original data. OneDrive is, by design, connected and synced.

What Happens When Ransomware Hits

This is where the difference becomes real. Here's the sequence of events we've seen play out:

1. Ransomware infects a user's laptop
2. Files on the laptop are encrypted — the originals are replaced with encrypted versions
3. OneDrive sync detects that files have "changed" and dutifully syncs the encrypted versions to the cloud
4. The encrypted versions overwrite the clean versions in OneDrive
5. The user checks OneDrive, hoping to find clean files — and finds encrypted ones

Now, OneDrive's version history can help in some cases. If you catch it quickly, you might be able to roll back individual files to pre-encryption versions. Microsoft also has a "Restore your OneDrive" feature that can roll back your entire OneDrive to a previous point in time (up to 30 days).

But here's the problem: this feature has limitations. It rolls back your entire OneDrive, not selective folders. It relies on the ransomware being detected quickly. And it only covers OneDrive — not SharePoint, not email, not Teams data, not anything else.

What Else OneDrive Doesn't Protect Against

Ransomware isn't the only risk. OneDrive also won't protect you from:

• Account compromise. If an attacker gains access to a user's Microsoft 365 account, they can delete files, empty the recycle bin, and remove data permanently — all within OneDrive.
• Admin errors. A well-meaning admin accidentally deletes a user's account or misconfigures a retention policy. OneDrive data may be permanently lost once the account deletion grace period expires.
• Microsoft outages or data loss. Rare, but it happens. Microsoft's service agreement explicitly states that they are not responsible for your data. They recommend third-party backup.
• Retention gaps. If a user leaves and their account is deleted, their OneDrive data is removed after a retention period (typically 30 days, extendable). If nobody realises those files were needed, they're gone.

Microsoft's Shared Responsibility Model

Microsoft operates what they call a "shared responsibility model." In plain English, this means:

Microsoft is responsible for: keeping the infrastructure running, the physical security of their data centres, and the availability of the service.

You are responsible for: your data, your access controls, your backup, and your compliance. Microsoft provides the platform. Protecting what's on it is your job.

They're telling you, in their own terms of service, to back up your data elsewhere. That should tell you everything about whether OneDrive counts as backup.

What Real Backup Looks Like

A proper backup for a small business using Microsoft 365 should include:

• Independent backup of OneDrive and SharePoint data — stored separately from Microsoft 365, with point-in-time restore capability
• Email backup — Exchange Online mailboxes backed up independently, including deleted items and archived mail
• Teams data backup — conversations, files shared in channels, and Teams configurations
• Automated daily (or more frequent) backups — not relying on someone remembering to run them
• Immutable storage — backup data that cannot be encrypted, deleted, or modified by ransomware (or a compromised admin account)
• Tested restores — regular verification that the backup actually works by restoring files from it
• Retention beyond 30 days — the ability to restore data from weeks, months, or years ago, depending on your needs

Third-party backup tools like Veeam, Datto, Acronis, and others are specifically designed for this. They connect to your Microsoft 365 tenant, back up everything to independent storage, and give you the ability to restore individual files, mailboxes, or entire accounts from any point in time.

The Bottom Line

OneDrive is excellent at what it does: syncing files across devices, enabling collaboration, and providing convenient cloud storage. Use it for that. But don't confuse it with a safety net.

When something goes properly wrong — ransomware, account compromise, accidental bulk deletion, a disgruntled employee — you need a backup that exists independently of the thing that went wrong. OneDrive, by definition, is part of the thing that went wrong.

We set up proper backup and disaster recovery for every managed IT client — independent of Microsoft 365, with daily automated backups, immutable storage, and tested restores. If you've already lost data, our data recovery service can help retrieve it.

Related Reading

• How to Back Up Your Business Data Properly
• Backups Are Not Disaster Recovery