"We're fine, we use OneDrive." It's a sentence we hear frequently. And we understand where it comes from. OneDrive is simple, it's integrated into Microsoft 365, and it gives the impression that data is safely stored in the cloud. In a sense it is, but that's not the same as a backup. And that difference can cost you dearly.

What OneDrive actually does

OneDrive is a synchronization service. When you save a file locally, it syncs to the cloud. Great. But synchronization works both ways, and that is the problem.

Imagine these scenarios:

  • An employee accidentally deletes an entire folder with five years of customer documents. The deletion syncs to OneDrive. The files are gone.
  • A ransomware attack encrypts all files on the computer. The encryption syncs to OneDrive. All cloud copies are now encrypted.
  • An employee overwrites an important file with incorrect data. The new version syncs. The original is gone.

OneDrive has versioning and a recycle bin, but it has limitations. The recycle bin is emptied automatically after 93 days. Versioning does not cover all file types. And in practice, many incidents are not discovered within that window.

Microsoft says so itself: Microsoft's service agreement specifies that Microsoft is not responsible for data loss in OneDrive and recommends that you maintain a separate backup. Responsibility for your data is yours.

What a real backup requires

A true backup differs from synchronization in three ways:

  1. Immutability: the backup cannot be overwritten or deleted by ransomware or human error. It is write-protected for a defined period.
  2. History: you can go back to any point within your retention period, not just the most recent version.
  3. Separation: the backup is physically or logically separated from the production environment. Encryption of your primary system does not affect your backup.

The 3-2-1 rule still applies

The fundamental backup standard is simple to remember:

  • 3 copies of your data
  • 2 different media types (e.g., disk and cloud)
  • 1 copy stored off-site (separated from your other systems)

For most SMBs today, that means: local backup on a NAS or external disk plus a cloud backup to a separate provider, not to the same Microsoft tenant as OneDrive.

What about SharePoint and Teams files?

Files in SharePoint and Teams are not automatically backed up either. Microsoft protects its infrastructure, not your data. That is an important distinction. Your Microsoft 365 tenant can be restored in the event of a Microsoft-side issue, but if you delete data yourself or suffer a ransomware attack, that is your responsibility.

The solution is a dedicated Microsoft 365 backup: solutions such as Veeam, Acronis, or Datto Backupify create independent copies of email, SharePoint, and Teams data that can be restored independently of Microsoft.

OneDrive is a good productivity tool. But it is not a backup, and you should not treat it as one.