In short
OneDrive for Business is not backed up in the way most people assume. Sync copies deletions and encrypted files everywhere, recycle bins hold items for 93 days in total and Files Restore reaches back 30 days. A OneDrive for Business backup keeps independent point-in-time copies, including leavers' files, for as long as your policy says.
Get a quote for OneDrive for Business backup
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Sync is not backup
OneDrive's job is to keep the same files on every device and in the cloud. That is exactly why it is not a backup. If a user deletes a folder on their laptop, the deletion syncs to OneDrive. If ransomware encrypts the files in a synced folder, the encrypted versions sync up and replace the good ones. If a sync conflict or a bad bulk move scrambles a folder structure, OneDrive records the new state as current.
Microsoft gives you tools to undo these changes for a while. A backup is a separate copy, outside the sync process, that you can return to after those tools have run out of road.
OneDrive's built-in protection and its limits
| Feature | What it does | Limit |
|---|---|---|
| Version history | Keeps earlier versions of each file | Per file; Microsoft says versions do not scale for mass ransomware recovery and can be exhausted |
| Recycle bins | Hold deleted files in a first-stage and second-stage recycle bin | 93 days in total from the original deletion |
| Files Restore (Restore your OneDrive) | Rolls a whole OneDrive back to an earlier point | The last 30 days; available to Microsoft 365 subscribers, including work or school accounts |
| Deleted user's OneDrive | Kept after the user's account is deleted, with access delegated to their manager or a secondary owner | 30 days by default (configurable), then 93 days in the site collection recycle bin, restorable only with PowerShell |
| Unlicensed OneDrive accounts | Archived rather than deleted when a user has no OneDrive licence | Archived on the 93rd unlicensed day; after 12 months of unpaid archive, Microsoft says the data may be deleted regardless of retention settings and holds |
| Microsoft 365 Backup | Paid Microsoft service with recovery points every 10 minutes for two weeks, then weekly | Restores a whole OneDrive account to a point in time, to the same or a new URL; billed separately |
Two details from Microsoft's documentation catch people out. The deleted-user clean-up only starts when the account is deleted from Entra ID; blocking sign-in or removing a licence does not start it, but an unlicensed account still heads towards archiving. And the recycle bin is not indexed, so an eDiscovery hold cannot find content that is sitting in it.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Where leavers' files fall through
When someone leaves, Microsoft's process gives their manager (or a secondary owner, if one is set) access to the OneDrive and emails a warning that it will be deleted at the end of the retention period, with a reminder seven days before. After that, the OneDrive moves to the site collection recycle bin for 93 days, where shared links stop working and only an administrator with PowerShell can bring it back.
In practice, managers are busy, the warning emails go unread and the files that matter, often the ones nobody else knew existed, are found to be missing months later. A backup takes the deadline out of offboarding: the leaver's OneDrive stays in backup for as long as your policy says, and can be restored into another user's OneDrive or exported when it is needed. Our guide on how to restore a deleted OneDrive covers both the native route and restoring from backup.
What a OneDrive for Business backup adds
- Independent copies: stored outside the sync process, so deletions and encrypted files do not overwrite them
- Point-in-time restore: return a file, a folder or a whole OneDrive to a moment before the problem
- Retention you set: keep copies for as long as your policy requires, not 30 or 93 days
- Leavers covered: keep a departed user's files after their account and licence have gone
- Search across users: find a file by name or content without knowing whose OneDrive it was in
- Restores that leave current work alone: restore to the original place or a separate location without overwriting newer files
Is OneDrive for Business backup the right fit for you?
We will check it against your systems and requirements and recommend the right option.
OneDrive backup coverage by platform
| Platform | OneDrive coverage | Worth knowing |
|---|---|---|
| Acronis Backup for Microsoft 365 | OneDrive files and folders, with optional OneNote notebooks | Search by file name, preview, and restore single files or folders to the original or another user; optional immutable storage |
| Axcient x360Cloud | OneDrive | Non-destructive, point-in-time and granular restore; SmartSearch across users; keeps data for departed staff, per Axcient |
| NinjaOne SaaS Backup for Microsoft 365 | OneDrive files and folders | Backups several times a day; restore a OneDrive folder from any point in the timeline |
| Redstor backup for Microsoft 365 | OneDrive files and folders with version history, and OneNote notebooks | InstantData streams files back first; every backup scanned for malware, per Redstor |
| Commvault backup for Microsoft 365 | OneDrive | Self-service restore and multiple geographic locations in the Enterprise editions; option to use Microsoft 365 Backup Storage for fast in-place restores |
The Microsoft 365 backup comparison sets these against Microsoft 365 Backup across every workload.
OneDrive ransomware recovery
Ransomware on a laptop with OneDrive sync running is the classic case for a separate backup. Files Restore can roll a single OneDrive back within 30 days, which works well for one user caught early. It is harder when many users are affected, the attack is found late, or an attacker with admin rights has also been deleting things in the tenant.
A backup lets you restore many OneDrive accounts to a clean point, and some platforms add protection of their own: Redstor scans backups for malware, Acronis applies AI-assisted anomaly detection to Microsoft 365 backups, and Axcient's AirGap separates and delays deletion requests. Microsoft 365 ransomware recovery sets out the recovery order.
OneDrive PC folder backup is a different thing
Windows and OneDrive offer a feature that backs up a PC's Desktop, Documents and Pictures folders to OneDrive. It is useful: a lost or broken laptop no longer means lost files. But it protects the device, not OneDrive itself. Once those folders are in OneDrive they are subject to the same sync, deletion and encryption risks as everything else, which is why a OneDrive for Business backup is still needed.
How we help
We look at how many OneDrive accounts you have, how much data they hold, how you handle leavers today and whether any unlicensed accounts are already heading for archive. Then we recommend a platform, help you set retention, can connect it to your tenant and run a test restore of a folder with you so the process is familiar. Licences and user changes are handled on one Forever Systems account, with terms confirmed at quote.
Contact us to protect your OneDrive for Business data.
How Forever Systems helps with Microsoft 365 backup
We are an independent UK IT and cyber security provider. We supply more than one Microsoft 365 backup product, so we can recommend what fits your tenant, your retention needs and your budget rather than one vendor's answer to everything.
- Review what you have: we look at your Microsoft 365 licences, retention policies and any existing backup before suggesting anything new
- Help you choose: we compare the backup products we supply against the workloads you need covered, such as Exchange Online, OneDrive, SharePoint, Teams and Entra ID
- Set-up and onboarding: we can help connect the backup service to your tenant and agree what is protected and how long copies are kept
- Restore testing: we can help you plan and run test restores so you know how recovery works before you need it
- Licensing in one place: backup licences alongside your Microsoft 365 subscriptions, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Contact us to talk it through.
Frequently asked questions
Is OneDrive for Business backed up?
Not independently. Microsoft keeps the service resilient and gives you version history, recycle bins for 93 days and Files Restore for 30 days, but these sit in your tenant and are time-limited. A third-party backup or Microsoft's paid Microsoft 365 Backup adds point-in-time copies kept to your policy.
How long does OneDrive keep deleted files?
Deleted files stay in the recycle bins for 93 days in total from the original deletion. Files Restore can roll a whole OneDrive back to any point in the last 30 days.
What happens to a leaver's OneDrive?
When the user's account is deleted, their OneDrive is kept for 30 days by default (configurable), with access for their manager or a secondary owner. It then moves to the site collection recycle bin for 93 days and can only be restored with PowerShell. Unlicensed accounts are archived on their 93rd unlicensed day.
Can ransomware encrypt files in OneDrive?
Yes. If ransomware encrypts files in a synced folder, the encrypted versions sync to OneDrive. Files Restore and version history can help within their limits; a backup lets you restore many accounts to a clean point.
Does Files Restore work for business accounts?
Yes. Microsoft says Restore your OneDrive is available to Microsoft 365 subscribers, including work or school accounts, and covers the last 30 days.
Still have a question about OneDrive for Business backup?
Ask us and a member of our team will reply by email.