In short
Microsoft 365 ransomware recovery means containing the compromised accounts and devices, finding the last clean point, and restoring OneDrive, SharePoint and Exchange data from before the attack. Microsoft's Files Restore and library restore reach back 30 days; Microsoft 365 Backup or a third-party backup held outside the tenant gives older, protected restore points.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
How ransomware damages Microsoft 365 data
Microsoft's own description of ransomware affecting SharePoint and OneDrive is useful here: the ransomware runs on a user's computer and manipulates files in a synced OneDrive folder or a mapped SharePoint library, and the sync client then copies the damage to the cloud. Microsoft lists the signs: most files share the same Modified By time, files will not open or appear corrupted, unfamiliar extensions have been added, and ransom notes appear in every folder.
That is one of three patterns worth planning for:
| Pattern | What happens | What is affected |
|---|---|---|
| Encryption through sync | Files on a device are encrypted and the sync client uploads the encrypted versions | OneDrive and any synced SharePoint or Teams libraries |
| Mass deletion by a compromised account | An attacker signed in as a user deletes files, mail or sites, and may empty recycle bins | Whatever that account can reach |
| Malicious admin actions | An attacker with admin rights deletes users, sites or mailboxes, changes retention or turns off protection | Potentially the whole tenant, including native recovery options |
The third pattern is the one that matters most when choosing a backup, because an attacker with admin rights inside your tenant can interfere with tools that live inside it. Keeping a copy outside the tenant, with separate credentials, is the point of immutable Microsoft 365 backup.
Not sure which plan fits? Ask us
Tell us what you need and we will help you choose the right plan.
The recovery order
Restoring too early can mean restoring into a tenant the attacker still controls, or syncing the encryption straight back. Work through these steps in order:
- Contain. Stop the OneDrive sync client or disconnect mapped drives on affected devices, as Microsoft advises, and isolate the devices. Reset passwords for affected accounts, revoke their sessions and review MFA methods and admin role assignments
- Scope. Work out which accounts, sites and mailboxes were touched and when the first malicious change happened. Audit logs and the backup product's own activity reports help
- Choose the clean point. Pick a restore point from before the first malicious change, not just before the ransom notes appeared
- Restore at scale. Restore the affected accounts and sites, starting with what people need to work; restore to an alternate location first if you are unsure the point is clean
- Verify. Check restored files open correctly, scan them, and confirm nothing malicious has been restored with them
- Report and learn. If personal data was affected, decide with your data protection lead whether the breach must be reported to the ICO (UK GDPR Article 33 sets a 72-hour expectation where feasible), and fix the weakness the attacker used
Recovery speed depends on data volume, the product and Microsoft's service limits, so we do not quote restore times. A tested restore is the only realistic guide.
Native Microsoft tools and their limits
Microsoft 365 includes several recovery features that help with ransomware, provided the incident is recent and the attacker did not remove them:
| Tool | What it does | Limit |
|---|---|---|
| Restore your OneDrive (Files Restore) | Rolls a whole OneDrive back to a point in the last 30 days | One account at a time; 30 days |
| Restore this library | Rolls a SharePoint or Teams document library back to a point in the last 30 days | Site admins; relies on version history and recycle bins |
| Version history and recycle bins | Earlier file versions; deleted items for up to 93 days | Microsoft says versions do not scale for mass ransomware recovery and can be exhausted |
| Microsoft Support request | Microsoft says SharePoint keeps backups for 14 days beyond deletion and admins can request a restore | 14 days; you request it, Microsoft performs it |
| Microsoft 365 Backup | Restore points for OneDrive, SharePoint and Exchange, with whole-account and whole-site rollback | Paid service set up in advance; no Teams chats or Entra ID; backups sit inside the Microsoft 365 boundary and the Backup admin can offboard them (with a 90-day grace period) |
Microsoft describes Microsoft 365 Backup as offering fast recovery from scenarios such as ransomware, and that is its real strength: large in-place restores from storage next to the live data. Our Microsoft 365 Backup Storage page covers it in full, and Microsoft 365 native backup vs third-party backup explains when an independent copy is worth adding.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Ransomware features in the backups we supply
Each of the five platforms keeps its backup outside your Microsoft 365 tenant. Beyond that, the vendors highlight different protections, which we attribute to them here:
| Platform | What the vendor highlights for ransomware |
|---|---|
| Redstor | Every backup is scanned for malware (Redstor describes the scanning as AI-powered), to reduce the risk of restoring infected files; immutable, encrypted backups; InstantData to stream back what people need first |
| Acronis | AI-assisted anomaly detection on Microsoft 365 backups to help flag unusual changes; optional immutable storage |
| Axcient x360Cloud | AirGap separates deletion requests from the deletion itself, with a delay in between, so backups cannot be wiped in one step; immutable audit logs |
| Commvault | Copies kept outside Microsoft 365 in a separate security domain, air-gapped and protected by zero trust access controls |
| NinjaOne SaaS Backup | Several incremental backups a day for recent restore points, point-in-time restore and an audit log; encryption in storage and transit per the vendor's security material |
The Microsoft 365 backup comparison puts these alongside workloads, retention and licensing.
Mailboxes and Entra ID after an attack
Files get most of the attention, but an attacker with a stolen account often touches mail and identity too.
Exchange Online. Deleted mail sits in recoverable items for 14 days by default (up to 30 if an admin has extended it), unless the attacker purged it. Microsoft 365 Backup can restore whole mailboxes or individual items to a point before the attack, for user and shared mailboxes, and a third-party backup can restore mail from copies held outside the tenant. Check also for changes an attacker leaves behind, such as inbox rules or forwarding, before you restore, so the restored mailbox is not compromised again.
Microsoft Entra ID. If an attacker deleted users or groups, or changed Conditional Access policies or app registrations, the native routes are the 30-day soft-delete period for supported objects and, for tenants with Entra ID P1 or P2, Microsoft Entra Backup and Recovery, which keeps up to seven days of daily backups and does not re-create hard-deleted objects. Seven days can be short if the attacker went unnoticed. NinjaOne SaaS Backup + Entra, Redstor's Restore and Comply bundles, Acronis and Commvault's separate Active Directory and Entra ID product offer longer, independent history; see Entra ID backup.
Prevention still matters
A backup decides how bad an incident gets; it does not stop one. Ransomware that reaches Microsoft 365 usually starts with a phished password or an infected device, so pair your backup with:
- Phishing-resistant MFA and Conditional Access, with as few standing admins as possible
- Endpoint protection on every device that syncs OneDrive; our licensing site lists anti-ransomware software
- Staff training so people recognise the first email; see ransomware awareness training
- Separate, MFA-protected credentials for the backup console, and alerts when backups are deleted or retention changes
The Microsoft 365 backup best practices checklist and Microsoft 365 backup compliance page cover the rest.
How we help
Before an incident, we can check whether your current Microsoft 365 data could be restored after an attacker gained admin rights, recommend and set up a backup held outside your tenant, and run a restore test with you. If you are dealing with an incident now, contact us and we can help you work out which recovery routes are still open. Pricing depends on users, data and retention, so ask us for a quote.
Contact us about ransomware-ready Microsoft 365 backup.
More on ransomware-resistant backup
How Forever Systems helps with Microsoft 365 backup
We are an independent UK IT and cyber security provider. We supply more than one Microsoft 365 backup product, so we can recommend what fits your tenant, your retention needs and your budget rather than one vendor's answer to everything.
- Review what you have: we look at your Microsoft 365 licences, retention policies and any existing backup before suggesting anything new
- Help you choose: we compare the backup products we supply against the workloads you need covered, such as Exchange Online, OneDrive, SharePoint, Teams and Entra ID
- Set-up and onboarding: we can help connect the backup service to your tenant and agree what is protected and how long copies are kept
- Restore testing: we can help you plan and run test restores so you know how recovery works before you need it
- Licensing in one place: backup licences alongside your Microsoft 365 subscriptions, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Contact us to talk it through.
Frequently asked questions
Can ransomware affect Microsoft 365?
Yes. Ransomware on a device can encrypt files in synced OneDrive folders or SharePoint libraries, and the sync client uploads the encrypted versions. A compromised account can also delete mail and files directly, and an attacker with admin rights can delete sites, users and mailboxes.
How do I recover OneDrive files after ransomware?
First stop the OneDrive sync client on affected devices and secure the account. Then use Restore your OneDrive to roll back to a point before the encryption, within the last 30 days, or restore from Microsoft 365 Backup or a third-party backup if you need an older point or many accounts at once.
Does Microsoft 365 protect against ransomware?
Microsoft provides recovery tools such as Files Restore, library restore, version history and recycle bins, and sells Microsoft 365 Backup. Under the shared responsibility model, protecting and recovering your data is still your responsibility, and the native tools are time-limited and inside your tenant.
Is Microsoft 365 Backup enough for ransomware recovery?
It gives fast, large-scale restores for OneDrive, SharePoint and Exchange, and Microsoft positions it for ransomware recovery. It does not cover Teams chats or Entra ID, and its backups sit inside the Microsoft 365 boundary, so many organisations also keep an independent copy held outside the tenant.
Should we pay the ransom?
That is a decision for your leadership with legal and law enforcement advice, and paying is no assurance that you will get your data back. A tested backup held outside your tenant is what gives you a choice.
Still have a question about Microsoft 365 ransomware recovery?
Ask us and a member of our team will reply by email.
More Microsoft 365 backup guides
Microsoft 365 BackupMicrosoft's own backup for OneDrive, SharePoint and Exchange, explained.