"We're fine, we use OneDrive." It's a sentence we hear frequently. And we understand where it comes from. OneDrive is simple, it's integrated into Microsoft 365, and it gives the impression that data is safely stored in the cloud. In a sense it is, but that's not the same as a backup. And that difference can cost you dearly.

What OneDrive actually does

OneDrive is a synchronization service. When you save a file locally, it syncs to the cloud. Great. But synchronization works both ways, and that is the problem.

Imagine these scenarios:

  • An employee accidentally deletes an entire folder with five years of customer documents. The deletion syncs to OneDrive. Recovery then depends on the recycle bin, retention settings, and when the incident is discovered.
  • A ransomware attack encrypts files on the computer. The encrypted versions can sync to OneDrive. Version history or a full OneDrive restore may help, but only within the available recovery window and configuration.
  • An employee overwrites an important file with incorrect data. The new version syncs. An older version may be recoverable, provided versioning is enabled and the version is still retained.

OneDrive has useful recovery features. Microsoft states that version history works with all file types and documents a 30-day window; for work or school accounts, an administrator may have disabled versioning. Deleted items in the recycle bin for those accounts are automatically removed after 93 days unless the administrator has changed the setting. Microsoft 365 subscribers can restore an entire OneDrive to undo file and folder actions from the last 30 days.

The important distinction: These recovery functions are part of the same Microsoft 365 environment. They are valuable, but they do not by themselves create an independent copy with separately controlled access and retention. If a file has been permanently deleted from the OneDrive recycle bin, Microsoft states that it cannot be recovered through OneDrive Restore.

What a real backup requires

A true backup differs from synchronization in three ways:

  1. Immutability: the backup cannot be overwritten or deleted by ransomware or human error. It is write-protected for a defined period.
  2. History: you can go back to any point within your retention period, not just the most recent version.
  3. Separation: the backup is physically or logically separated from the production environment. Encryption of your primary system does not affect your backup.

The 3-2-1 rule still applies

The fundamental backup standard is simple to remember:

  • 3 copies of your data
  • 2 different media types (e.g., disk and cloud)
  • 1 copy stored off-site (separated from your other systems)

For most SMBs today, that means: local backup on a NAS or external disk plus a cloud backup to a separate provider, not to the same Microsoft tenant as OneDrive.

What about SharePoint and Teams files?

SharePoint and Teams files have built-in versioning, recycle-bin, and retention options. Those controls can support recovery, but they are not automatically a separate backup with an independent administrative boundary and retention policy. Microsoft 365 Backup, for example, requires separate backup policies for OneDrive, SharePoint, and Exchange.

The solution is a dedicated Microsoft 365 backup: solutions such as Veeam, Acronis, or Datto Backupify create independent copies of email, SharePoint, and Teams data that can be restored independently of Microsoft.

OneDrive is a good productivity tool. But it is not a backup, and you should not treat it as one.