OneDrive gives you real ransomware protection: virus scanning, attack alerts and a way to roll files back to a point before the damage. For Microsoft 365 subscribers, that rollback reaches back 30 days. It works best as one layer of a larger plan, because OneDrive syncs your files, and syncing can carry encrypted files into the cloud along with everything else. This guide explains what OneDrive does, how a ransomware attack plays out on a synced folder, and the steps that keep a small business recoverable.
Key Takeaways
- OneDrive detects some ransomware attacks, alerts Microsoft 365 subscribers, and lets them restore files to a point before the attack, up to 30 days back.
- Sync is the weak point: encrypted files can upload through the sync client, so your first move in an attack is to stop syncing and clean every device.
- Restore works inside fixed windows. Know them, and keep a separate, tested backup for anything you cannot afford to lose.
- Protection is a stack: multi-factor authentication, endpoint protection, correct sharing settings, versioning and an independent backup you have actually restored from.
Table of Contents
- How OneDrive Protects You From Ransomware
- Why Sync Is Both the Strength and the Risk
- Files Restore: Your Main Recovery Tool
- What to Do if Ransomware Hits Your OneDrive
- OneDrive Protection vs. a Real Backup
- A Practical Checklist to Protect OneDrive From Ransomware
- Industry Notes: Dental Practices, Law Firms and Others
- How Great Plains Networking Helps
- FAQ
- Sources
How OneDrive Protects You From Ransomware
OneDrive's defenses fall into three groups: scanning, detection and recovery.
Scanning. Microsoft says OneDrive scans files for known threats on download, using the Windows Defender anti-malware engine, updated hourly. Across SharePoint, OneDrive and Teams, Microsoft 365 uses a common virus detection engine. Scanning may run asynchronously after upload, and if a file has not been scanned yet, a scan can be triggered before the download is allowed.
Detection and alerts. Microsoft 365 subscribers get an alert when OneDrive detects a ransomware or other malicious attack. OneDrive also monitors for suspicious activity and sends email notifications about unusual activity, according to Microsoft's OneDrive safeguards page. When a detection happens, you get a notification on your device and an email, and Microsoft 365 guides you through restoring your OneDrive files.
Recovery. Two features do most of the work: Files Restore and version history. Both are covered below.
There is also a link to your endpoint protection. When Microsoft Defender Antivirus detects ransomware on a device, it tells you, helps remove the threat, and offers to recover your files in OneDrive to their state before the attack. That is why Windows security screens often suggest setting up OneDrive. It is a recovery path, not a sign that something is wrong with your computer.
Why Sync Is Both the Strength and the Risk
OneDrive is a sync service. Whatever changes in a synced folder on a PC is copied to the cloud. That is convenient for everyday work, and it is also how ransomware travels.
Microsoft describes the pattern plainly: in a ransomware attack, encrypted and modified files synchronize to the online environment through the sync client. The cloud copy does not stay clean just because it is in the cloud. What protects you is the ability to go back in time, not the sync itself.
A related point: a malicious file can sometimes reach a local machine before the service marks it as malware. Microsoft notes that a file may sync to a device before it is flagged, after which the user cannot open the synced copy there. Scanning reduces risk. It does not replace endpoint protection and careful email habits.
What a typical attack looks like in a synced folder
- An employee opens a malicious attachment or link on a Windows PC.
- Ransomware starts encrypting documents on the local drive, including the OneDrive folder.
- The sync client sees changed files and uploads the encrypted versions.
- Other devices syncing the same folders start receiving encrypted files.
- Someone notices that files will not open, or an alert arrives.
The damage window is the time between step 2 and step 5. Every minute of it matters, which is why monitoring and fast response count as much as the software itself.
Files Restore: Your Main Recovery Tool
For Microsoft 365 subscribers, Restore your OneDrive can undo actions on files and folders within the last 30 days. That includes files that were deleted, overwritten, corrupted or infected by malware. You pick a restore point, review the activity chart, and roll back.
Two details are worth knowing before you ever need them:
- Files and folders you created after the restore point date are sent to the OneDrive Recycle Bin. Pick your restore point carefully, ideally just before the first sign of trouble.
- A file permanently deleted from the OneDrive Recycle Bin cannot be recovered with this tool.
Version history
Versioning is the second safety net. Microsoft says it retains at least 500 versions of a file by default, so if ransomware edits and encrypts a file, an earlier version can be recovered. Files Restore covers the last 30 days.
When the attacker deletes the originals
Some ransomware creates a new encrypted copy and deletes the old file. In that case Microsoft states that customers have 93 days to restore the deleted file from the recycle bin. After 93 days there is a further 14-day window in which Microsoft can still recover the data, and after that it is permanently deleted.
These windows are generous for a quick discovery. They are tight for an infection that sits quietly for weeks, which is why a separate backup with longer retention belongs in the plan.
What to Do if Ransomware Hits Your OneDrive
Speed and order matter. This sequence follows Microsoft's published recovery guidance.
- Stop the sync. Microsoft advises immediately stopping OneDrive sync or disconnecting the mapped drive, then trying to restore the files. This keeps more encrypted files from replacing good ones.
- Confirm the files are infected. Look at what changed and when. Microsoft's process starts by confirming infection, then cleaning devices, then restoring OneDrive.
- Clean every device that uses the account. Use antivirus software on all of them. Microsoft warns that if you restore before the devices are clean, the files could get encrypted again.
- Restore to a point before the attack. Use Restore your OneDrive and choose a date and time ahead of the first encrypted file.
- Reset credentials and review access. If the attack came through a phished password, changing it and checking sign-in activity closes the door you came in through.
- Document what happened. Record timelines, affected folders and actions taken. Regulated businesses such as dental practices and law firms may have notification duties, so involve your IT provider and counsel early.
For a fuller response plan covering the whole business, not just OneDrive, see our ransomware recovery playbook. If you are weighing what an incident could cost a local company, our breakdown of ransomware recovery costs in Oklahoma City gives you a realistic frame.
OneDrive Protection vs. a Real Backup
Small businesses often treat OneDrive as their backup. It is better described as file sync with recovery features. The difference shows up in a few places:
| Question | OneDrive built-in recovery | Independent, tested backup |
|---|---|---|
| How far back can you go? | 30 days for Files Restore; 93 days plus 14 for deleted items in the recycle bin | Set by your retention policy, often months or longer |
| Does an encrypted sync carry into it? | Yes, until you stop syncing and roll back | Separate copy, so it can stay clean |
| Who can alter it? | Anyone whose account is compromised | Can be isolated or immutable, so attackers cannot delete it |
| Is recovery proven? | Depends on you trying it | Restore tests can be scheduled and documented |
The classic 3-2-1 rule is a good test: three copies of your data, on two different types of storage, with one copy offsite. A synced OneDrive folder on a laptop gives you two copies that move together. It does not satisfy the rule on its own.
Two terms to keep in mind when you talk to anyone about recovery:
- RPO (recovery point objective): how much recent work you can afford to lose. If your RPO is a few hours, a 30-day rollback does not tell you whether you can hit it. Your backup schedule does.
- RTO (recovery time objective): how long you can be down. A restore of a large file library takes time, and you want to know how long before you are under pressure.
Microsoft also notes that retention settings can copy versions of SharePoint or OneDrive documents to the Preservation Hold library as separate items for investigation. That is useful for legal holds and forensic work, and it is something to configure deliberately rather than assume.
A Practical Checklist to Protect OneDrive From Ransomware
These steps work for a 5-person office or a 50-person one. Most can be done in an afternoon.
Lock down accounts
- Turn on multi-factor authentication (MFA) for every user, starting with administrators and anyone who handles payments or client records.
- Block legacy sign-in methods that skip MFA.
- Review who has admin rights and remove any that are not needed.
Protect the devices
- Keep Microsoft Defender Antivirus, or another managed endpoint tool, running and updated on every PC and laptop that syncs OneDrive.
- Apply Windows and Office updates promptly. Many ransomware infections use known holes that have patches.
- Keep personal devices off business OneDrive libraries unless they are managed.
Tighten sharing and sync
- Limit external sharing to the people and domains that need it.
- Sync only the libraries each person works in, not everything.
- Train staff to stop and report when files suddenly will not open or file names change. Reporting in minutes, not hours, shrinks the damage.
Prepare recovery before you need it
- Check that your Microsoft 365 plan includes Files Restore. Microsoft describes it as available to Microsoft 365 subscribers.
- Practice a restore on a test folder so you know where the buttons are.
- Keep an independent backup of OneDrive, SharePoint and mailbox data with longer retention, and test restoring from it on a schedule.
- Write a one-page response plan: who stops sync, who calls IT, who calls clients, who talks to insurance.
For email-borne attacks, the most common entry point, our guide to protecting your business from ransomware attacks covers the wider set of defenses. If you manage the Microsoft 365 tenant yourself, the Microsoft 365 Defender setup guide walks through rolling out mail protection without breaking mail flow.
Industry Notes: Dental Practices, Law Firms and Others
The same OneDrive features apply across industries, but the stakes differ.
- Dental and medical practices: patient records may fall under HIPAA. A ransomware event can be a reportable incident, so access controls, logging and a documented recovery plan matter as much as the technology.
- Law firms: client confidentiality and matter files make sharing settings and data loss controls a priority. Our guide to Microsoft 365 data loss prevention explains how to roll out policies without disrupting work.
- Accounting and real estate: tax and closing season bring heavy file traffic and high phishing volume. Restore points and backups need to be fresh when deadlines peak.
- Manufacturers: shared drawings and job files often live beside network equipment and shop-floor systems. Segmenting the network limits how far an infection can spread.
- Nonprofits: donor and grant data are valuable and often protected by a small team. Simple, consistent controls such as MFA and managed backups carry the most weight.
How Great Plains Networking Helps
If you would rather not carry this on your own, we handle it for small businesses in Norman, Moore and Oklahoma City. Our managed IT support includes 24/7 monitoring so problems are caught before they interrupt your day, and we respond the same day when you call. We explain things in plain language, and we do not require long-term contracts.
For OneDrive and ransomware specifically, the work usually covers three areas: Microsoft 365 support to configure MFA, sharing and retention correctly, cybersecurity covering ransomware and phishing protection, and backup and recovery so you have a copy that sits outside your sync. Not sure where you stand? Start with the 10-minute readiness audit or ask for a free network assessment from our home page.
FAQ
Does OneDrive protect against ransomware?
Partly. OneDrive scans for known threats, alerts Microsoft 365 subscribers when it detects an attack, and lets them restore files to an earlier point, up to 30 days back. It does not stop ransomware from encrypting files on your PC, and those encrypted files can sync up. Pair it with endpoint protection, MFA and an independent backup.
Can ransomware infect files stored in OneDrive?
Encrypted files can reach OneDrive through the sync client, so the cloud copy can be affected. Microsoft scans uploaded files, but scanning can run after upload, and a malicious file may sync before it is flagged. If you suspect an attack, stop syncing right away and restore from a point before the damage.
How do I restore OneDrive files after a ransomware attack?
Stop the sync, confirm the infection, and clean every device that uses the account with antivirus software. Then use Restore your OneDrive and choose a date before the attack. Restoring before cleaning can let the files be encrypted again.
Is OneDrive enough as a business backup?
For most businesses, no. Files Restore covers 30 days, and recycle bin recovery has its own limits, so a quiet infection can outlast them. A separate backup with longer retention and regular restore tests gives you a clean copy outside the sync.
Should I stop using OneDrive to avoid ransomware?
There is no need. Used with MFA, protected devices and a backup, OneDrive is a sound way to store and share files. Microsoft's advice for an active attack is narrower: stop the sync or disconnect the mapped drive, then restore.
Sources
- How OneDrive safeguards your data in the cloud, Microsoft Support
- Better together: Microsoft Defender Antivirus and Office 365, Microsoft Learn
- Built-in virus protection in SharePoint, OneDrive and Teams, Microsoft Learn
- Handling ransomware in SharePoint Online, Microsoft Learn
- How to detect ransomware and recover files using OneDrive, Microsoft Support
- Ransomware protection in Microsoft 365, Microsoft Learn
- Restore your OneDrive, Microsoft Support