Does OneDrive Backup Everything? (w/Examples) + FAQs

No. OneDrive does not back up everything on your computer, phone, or Microsoft 365 account. OneDrive is a sync-and-share service, not a true backup tool, and it only protects the files you place inside its synced folders. Anything outside those folders, such as program files, system settings, Outlook PST archives, external drives, or network shares, stays unprotected unless you add a real backup solution.

This matters because millions of users assume their data is safe the moment the little blue cloud icon appears in the taskbar. The Microsoft Services Agreement places the duty of keeping a separate backup on you, the customer, and federal guidance from the NIST Cybersecurity Framework recommends the 3-2-1 rule: three copies, two media, one offsite. OneDrive, on its own, gives you only one copy in one place.

The consequence of that gap shows up every day. According to the 2024 Veeam Data Protection Trends Report, 76% of organizations suffered at least one ransomware attack in the prior year, and SaaS data like OneDrive was a top target. A single ransomware hit can sync encrypted files to the cloud in minutes, and a 30-day recycle bin is rarely enough to recover cleanly.

Here is what you will learn in this guide:

• 🧠 What OneDrive actually backs up and what it silently ignores
• 📂 How Known Folder Move (KFM) works and where it fails
• ⚖️ The legal and compliance risks of treating sync as backup under HIPAA and SOX
• 🛡️ The 3-2-1 rule and how to add a real backup layer to OneDrive
• 🚫 The most common mistakes users make and how to avoid them

What OneDrive Actually Is (and Is Not)

OneDrive is a cloud storage and file synchronization service built by Microsoft. It keeps a single living copy of your files mirrored between your device and Microsoft’s servers. When you edit a file on your laptop, the change syncs up. When you delete a file on your laptop, the deletion syncs up too, and that is the core reason sync is not backup.

A true backup service keeps point-in-time copies that are separate from the live data. If the live copy is encrypted, deleted, or corrupted, the backup still holds a clean version from yesterday, last week, or last month. Microsoft explains this directly in its own shared responsibility documentation, where it states customers are responsible for their data.

The plain-English version is simple. OneDrive protects you from a dead hard drive because the file lives in the cloud. It does not protect you from your own mistakes, from ransomware that encrypts the synced folder, from a rogue employee, or from a long-running corruption that quietly replicates to the cloud copy.

The consequence of confusing the two is data loss that feels sudden but was actually baked in from day one. A real-world example: Maria runs a small accounting firm in Ohio. She moved her client files into OneDrive in 2024 and canceled her local backup service. In 2026, a CryptoLocker variant encrypted every synced file. The encrypted versions synced to the cloud within ten minutes, and Maria had no older copy to restore.

A common misconception is that the OneDrive Recycle Bin is a backup. It is not. The bin only holds deleted items for 30 days for personal accounts and 93 days for business accounts, per Microsoft’s retention documentation. Files that were modified or encrypted in place never enter the bin.

Sync vs. Backup: The Core Difference

Sync mirrors one live copy across devices. Backup stores isolated, versioned copies that survive the death of the live copy. Microsoft’s product pages describe OneDrive as a place to access your files from anywhere, not as a place to recover from disaster.

The consequence of using sync as backup is that a single bad event, like ransomware, accidental mass deletion, or a bad sync client bug, propagates everywhere. Every device pulls the same corruption.

A concrete example: Jamal is a freelance video editor. He edits 4K footage stored in his OneDrive folder. One night, his editing software crashes and writes a corrupt file. The corrupt file syncs up, overwrites the cloud copy, and syncs to his backup laptop. All three copies are the same broken file.

A common misconception is that “cloud equals safe.” The cloud is durable against hardware failure, but it is not immune to user error or malicious action. The CISA guidance on cloud backup explicitly warns against treating a single cloud copy as a complete recovery strategy.

The Microsoft Shared Responsibility Model

Microsoft runs the infrastructure, patches the servers, and guarantees uptime. You are responsible for the content, for access control, and for recovering from your own mistakes. This split is written into the Microsoft 365 shared responsibility model.

The consequence of ignoring this model is that when something goes wrong, Microsoft support will restore the service, but they will not restore your individual files beyond the standard retention windows. You own the recovery plan.

For example, Priya is an HR director at a 200-person firm. An ex-employee’s OneDrive was set to auto-delete 30 days after offboarding. Priya needed an old contract 90 days later and found the data gone forever. The shared responsibility model placed the duty to preserve that data on her team, not on Microsoft.

A common misconception is that paying for Microsoft 365 includes full data protection. It includes service availability, not data retention beyond the defaults.

What OneDrive Does Back Up

OneDrive does protect a specific, defined set of items when you configure it correctly. Through a feature called Known Folder Move, or KFM, OneDrive can redirect and sync three Windows folders: Desktop, Documents, and Pictures. On newer Windows 11 builds, the list expands to include Music and Videos.

KFM is the closest OneDrive gets to a “backup everything” experience for a typical Windows user. When enabled, every file dropped into those five folders syncs to the cloud and across devices. The consequence of enabling KFM is that a laptop theft or a hard drive failure no longer wipes out the user’s working documents.

A real example: Derek is a sales manager who lost his Surface laptop in an airport. Because his IT team had pushed KFM through Microsoft Intune policy, his Desktop and Documents were already in OneDrive. He signed into a loaner laptop and had every file back within an hour.

A common misconception is that KFM covers the whole C: drive. It does not. KFM only covers those named folders, and anything stored elsewhere, like C:\Projects or D:\Archive, is invisible to OneDrive.

Files Inside the OneDrive Folder

Any file you drag into the OneDrive folder, or save directly using Office apps, syncs automatically. This includes Word, Excel, PowerPoint, PDFs, images, and most file types. Microsoft documents the full sync behavior in the OneDrive sync client reference.

The consequence of this simple rule is that file placement becomes the single most important decision. Files inside the folder are protected against device loss. Files outside are not.

For example, Lin saves her thesis drafts to C:\Users\Lin\OneDrive\Thesis. Every save triggers a sync. When her laptop died the week before her defense, she logged into onedrive.live.com and downloaded the latest draft in minutes.

A common misconception is that OneDrive “scans your whole computer for important files.” It does not. It only watches the folders you tell it to watch.

Photos and Videos from Mobile Devices

The OneDrive mobile app on iOS and Android offers Camera Upload, which auto-uploads new photos and videos from your phone’s camera roll into a folder called Camera Roll or Pictures.

The consequence of enabling Camera Upload is that a lost or broken phone no longer means lost memories. However, deletions on your phone do not remove the cloud copy, which is a rare case where OneDrive behaves slightly more like backup than sync.

A real example: Tomas dropped his iPhone into a lake on vacation. Because Camera Upload was on, all 3,200 photos from the trip were already in OneDrive before the phone died.

A common misconception is that Camera Upload grabs WhatsApp, Signal, or Messages media automatically. It typically only grabs the default camera roll, and app-specific folders must be added manually.

Version History on Office Files

OneDrive keeps up to 500 versions of each file for up to 30 days for most file types, and longer for Office documents. The full policy lives in the OneDrive version history article.

The consequence is that accidental edits can be rolled back inside the 30-day window. The limit is that versions older than 30 days are typically gone, and ransomware often sits silently for weeks before detonating.

For example, Anika overwrote a client proposal with the wrong template. She opened OneDrive on the web, clicked Version History, and restored the prior version in under a minute.

A common misconception is that version history is unlimited. It is not, and it does not survive certain types of mass corruption events.

What OneDrive Does NOT Back Up

This is where most users get burned. OneDrive ignores huge swaths of your digital life by default, and there is no warning light telling you what is missing. The official Microsoft OneDrive FAQ confirms these gaps.

The consequence of these gaps is that many users believe they are fully protected when they are, in fact, exposed on multiple fronts.

Program Files and System Settings

OneDrive does not back up Windows itself, installed applications, drivers, the registry, or OS-level settings. If your hard drive dies, OneDrive brings back your Documents, not your Adobe Creative Suite install, your license keys, or your custom registry tweaks.

The consequence is a painful rebuild process after device failure. You must reinstall every program, reapply every license, and reconfigure every setting by hand. Tools like Windows Backup or third-party image backup software handle this layer, not OneDrive.

For example, Carlos is a graphic designer with a specialized font library and Photoshop plugins. After a drive failure, his OneDrive files were safe, but he spent two full days reinstalling software and hunting down license keys.

A common misconception is that Microsoft 365 subscriptions “remember” your installs. They remember your license, not your plugins, presets, or custom configurations.

Outlook PST and OST Files

Outlook stores local email archives in .pst and .ost files. Microsoft explicitly blocks syncing PST files through OneDrive when they are open in Outlook and warns against it in Microsoft’s PST sync guidance.

The consequence of attempting to sync a PST is file corruption, sync conflicts, and possible loss of years of email history. PSTs often grow to tens of gigabytes and are actively written to while Outlook is open.

For example, Rebecca tried to save her 40 GB PST in her OneDrive folder. Within a week, the file showed sync errors, and opening it in Outlook produced “file corrupt” warnings.

A common misconception is that mailbox data inside Microsoft 365 Exchange Online is backed up indefinitely. Deleted mail generally leaves the Recoverable Items folder after 14 to 30 days unless you apply a retention or litigation hold.

External Drives and Network Shares

OneDrive cannot sync folders stored on external USB drives, mapped network drives, or NAS devices. It only syncs folders that live on the local device’s primary drive tree, as confirmed in Microsoft’s sync restrictions.

The consequence is that large media libraries, archive drives, and shared team folders on a NAS remain unprotected. Users often assume “it’s all in my cloud,” not realizing the external drive is invisible.

For example, Ben stores his video archive on a 10 TB external drive. He assumed OneDrive would grab it automatically. When the drive failed, he lost eight years of footage.

A common misconception is that pointing OneDrive at an external drive will sync it. The sync client will usually refuse, and workarounds create sync conflicts.

System Files, Hidden Files, and Certain File Types

OneDrive blocks certain file names, path lengths over 400 characters, and restricted characters like <, >, :, ", /, \, |, ?, and *. The full list sits in the invalid file names reference.

The consequence is that legitimate files can silently fail to sync without the user noticing. Code repositories, legacy documents, and some design files run into this regularly.

For example, Elena is a developer whose node_modules folder contained paths over 400 characters. Those files silently stayed local, and when she switched laptops, her build broke.

A common misconception is that sync errors are always obvious. They are not, and many users only see a small warning badge on the OneDrive icon.

SharePoint, Teams, and Other Microsoft 365 Data

OneDrive does not back up SharePoint sites, Teams chats, Planner tasks, OneNote notebooks stored outside OneDrive, or Power Platform data. Each service has its own retention rules, and most default to limited recovery windows per Microsoft 365 service retention documentation.

The consequence is that a deleted SharePoint site is typically recoverable for only 93 days, and a deleted Teams channel message may be lost after shorter windows.

For example, Nadia is a project manager whose Teams channel was accidentally deleted. Her IT team recovered most of it, but the attached Planner tasks were unrecoverable.

A common misconception is that “Microsoft 365 backs up everything in Microsoft 365.” It does not, and third-party tools like Veeam Backup for Microsoft 365, Barracuda Cloud-to-Cloud Backup, or AvePoint Cloud Backup exist precisely to fill this gap.

Three Real-World Scenarios

These three situations show how the OneDrive gap plays out in real life. Each one is based on common support tickets reported across the Microsoft Tech Community forums.

Scenario Table 1: Ransomware Hits a Synced Folder

Scenario Table 2: Employee Offboarding

Scenario Table 3: Accidental Mass Deletion

Compliance and Legal Risks

Treating OneDrive as a complete backup is not only a technical mistake. It can also create legal exposure under several U.S. frameworks. The HIPAA Security Rule requires covered entities to keep “retrievable exact copies” of electronic protected health information. A single synced copy fails that test.

The consequence of a HIPAA failure is steep. Penalties range from $141 to $71,162 per violation under the HHS 2024 penalty adjustments, with annual caps over $2 million per category.

A real example: Dr. Alvarez runs a small dental practice. He used OneDrive as his only copy of patient records. A ransomware attack encrypted the synced folder, and he could not produce the required retrievable copies during an HHS audit. The fine and notification costs crushed the practice.

A common misconception is that Microsoft’s HIPAA-eligible services handle compliance for you. Microsoft offers a Business Associate Agreement, or BAA, but the duty to maintain retrievable backups still sits with the covered entity.

SOX and Financial Records

Public companies must preserve financial records for auditors under the Sarbanes-Oxley Act of 2002. Section 802 mandates a minimum five-year retention for audit work papers, and Section 404 requires internal controls over data integrity.

The consequence of a SOX failure is personal liability for executives, with fines up to $5 million and prison terms up to 20 years for willful violations.

For example, a controller at a mid-cap firm stored audit work papers in OneDrive. After an accidental mass deletion and 94 days of inactivity, the files were gone, and the external auditor flagged a material weakness in internal controls.

A common misconception is that “electronic records are forever.” They are not, and default Microsoft 365 retention windows often fall far short of SOX’s five-year floor.

State Data Breach Laws

All 50 states now have breach notification laws, and several, like the California Consumer Privacy Act and the New York SHIELD Act, require reasonable safeguards including backup and recovery.

The consequence of a breach tied to poor backup hygiene is mandatory customer notification, possible private lawsuits, and state attorney general investigations.

For example, a New York retailer lost customer order history when a OneDrive sync bug propagated corruption. Because the business had no offline backup, it had to notify 40,000 customers and settle a class action.

A common misconception is that only federal law matters. State laws often impose stricter and earlier notification duties.

The 3-2-1 Rule and How to Apply It With OneDrive

The 3-2-1 rule, endorsed by CISA and the US-CERT data backup options guide, says: keep 3 copies of your data, on 2 different media, with 1 copy offsite.

OneDrive can serve as one of those copies, but it cannot be all three. The consequence of ignoring this rule is that any single failure, cloud outage, account compromise, or ransomware attack, can wipe your only copy.

Copy 1: The Live Copy on Your Device

This is the working file on your laptop or phone. It is the fastest to access but also the most exposed to theft, damage, and user error.

For example, Hannah, a freelance writer, keeps her active manuscript on her MacBook. It is her daily driver, and losing it would halt her work.

A common misconception is that the live copy is a backup. It is not; it is the source.

Copy 2: OneDrive (Cloud Sync)

OneDrive serves as the second copy, synced continuously and available across devices. This copy protects against hardware failure and device loss.

The consequence of stopping here is that a ransomware attack or mass deletion can still wipe both copies together, since they are linked.

For example, Hannah’s manuscript also lives in OneDrive. If her MacBook dies, she downloads it from the OneDrive web portal and keeps writing.

A common misconception is that cloud sync counts as “offsite backup.” It is offsite storage, but it is not an isolated backup.

Copy 3: A True Backup (Offsite, Versioned, Isolated)

The third copy should be a real backup, such as Backblaze Personal Backup, Carbonite Safe, Acronis Cyber Protect, or a Veeam Backup for Microsoft 365 instance held in a separate cloud.

The consequence of skipping this copy is that you remain one bad click, one outage, or one ransomware strain away from total loss.

For example, Hannah adds Backblaze for $99 per year. Now her manuscript exists on her laptop, in OneDrive, and in Backblaze’s immutable storage with 30-day version history. That is true 3-2-1.

A common misconception is that a second cloud folder (like syncing OneDrive to Dropbox) counts as the third copy. It does not, because it is still sync, not versioned backup.

Mistakes to Avoid

These are the seven most common and most costly mistakes people make with OneDrive.

• Treating OneDrive as the only copy. The consequence is total data loss after any ransomware or mass deletion event, because there is no isolated recovery point.
• Ignoring Known Folder Move. The consequence is that Desktop, Documents, and Pictures files stay local-only, and a dead laptop takes them to the grave.
• Storing PST files in OneDrive. The consequence is file corruption, sync errors, and a likely loss of years of archived email because Outlook writes to the file continuously.
• Assuming the Recycle Bin is backup. The consequence is permanent loss, because deleted items leave the second-stage bin after 93 days (business) or 30 days (personal), per the Microsoft retention policy.
• Leaving sync errors unresolved. The consequence is silent data loss, because flagged files never reach the cloud, and the user often does not notice the warning badge.
• Failing to transfer files before offboarding an employee. The consequence is a hard 30-day deletion of the ex-employee’s OneDrive, with no way to recover the data afterward.
• Confusing SharePoint Online with OneDrive. The consequence is misplaced trust, since each service has different retention and recovery rules, and a site deletion is not undone by OneDrive alone.
• Disabling version history to save space. The consequence is no rollback option when a file is overwritten, edited wrongly, or partially encrypted.
• Skipping multi-factor authentication. The consequence is account takeover, and an attacker inside your OneDrive can delete or encrypt files faster than you can respond, per CISA’s MFA guidance.

OneDrive vs. Real Backup Tools

This side-by-side shows where OneDrive stops and where dedicated backup tools begin. Pricing and features reflect 2026 public plans.

Named Examples of OneDrive Data Loss and Recovery

These examples show how real people win and lose with OneDrive.

Example 1: Laura the Nurse Practitioner

Laura runs a small clinic and stored patient intake forms in OneDrive for Business. She enabled HIPAA-eligible services under a BAA but skipped a third-party backup.

A ransomware attack encrypted 14,000 files. Version history recovered most files from within 30 days, but 1,200 files were older and unrecoverable. Laura paid for HHS-required breach notifications to affected patients.

The lesson: even HIPAA-eligible services need an independent backup for older records.

Example 2: Marcus the Startup Founder

Marcus built a seed-stage SaaS company and kept all engineering notes in OneDrive. He added Veeam Backup for Microsoft 365 on day one.

When a departing engineer’s account was deleted by mistake, Marcus restored the entire mailbox and OneDrive from Veeam in under an hour. Investors praised the recovery posture during due diligence.

The lesson: a proper third-party backup pays off the first time something goes sideways.

Example 3: The Johnson Family

The Johnsons used OneDrive Personal with 1 TB of storage through Microsoft 365 Family. They enabled Camera Upload on four phones and KFM on two laptops.

When their basement flooded and destroyed a home office PC, every photo, document, and desktop file was already in OneDrive. They bought a new PC, signed in, and were fully restored within a day.

The lesson: for consumer use with low risk tolerance, OneDrive plus KFM plus Camera Upload covers the most common household disasters, though adding Backblaze Personal at $99 per year would complete a true 3-2-1.

Do’s and Don’ts

Do’s

• Do enable Known Folder Move to protect Desktop, Documents, and Pictures, because those are where most working files live.
• Do turn on Camera Upload on every mobile device, because phone loss is the number one way people lose photos.
• Do add a third-party backup like Veeam, Backblaze, or Acronis, because the 3-2-1 rule demands a second, independent copy.
• Do require multi-factor authentication on every OneDrive account, because account takeover is the fastest path to data loss, per CISA MFA guidance.
• Do set retention and litigation holds in Microsoft Purview for regulated data, because default retention is often shorter than legal requirements.
• Do monitor sync errors through the OneDrive activity center, because silent failures are where most quiet data loss happens.

Don’ts

• Don’t store open PST files in OneDrive, because Outlook writes to PSTs continuously and sync will corrupt them.
• Don’t rely on the Recycle Bin as backup, because retention ends at 30 or 93 days and purges are permanent.
• Don’t assume SharePoint and Teams are covered, because each has separate retention rules that OneDrive does not extend.
• Don’t delete an employee’s license before transferring files, because the 30-day offboarding clock starts immediately.
• Don’t store large media libraries on external drives and assume OneDrive grabs them, because external storage is outside the sync scope.
• Don’t disable version history to save space, because it is one of the few built-in recovery tools you have.

Pros and Cons of OneDrive as Backup

Pros

• Seamless integration with Windows and Microsoft 365, which means setup is minutes, not hours, for typical users.
• Automatic syncing across devices, which gives you working access anywhere and reduces the pain of device loss.
• Included with most Microsoft 365 plans, which means no extra budget line item for 1 TB per user.
• 30-day version history, which handles most accidental overwrites inside the window.
• Known Folder Move, which covers the three most-used Windows folders with one policy toggle.
• Camera Upload on mobile, which protects phone photos against loss and theft automatically.

Cons

• Sync is not backup, which means ransomware and mass deletions propagate to the cloud copy within minutes.
• Limited retention windows, which often fall short of HIPAA, SOX, and state retention requirements.
• No coverage of external drives, NAS shares, or system files, which leaves entire categories of data unprotected.
• Account compromise = data compromise, which means one stolen password can wipe all synced copies at once.
• No immutable or air-gapped copy, which is now the baseline for ransomware defense per CISA ransomware guidance.
• Deleted user data gone in 30 days by default, which creates compliance risk during offboarding.

How to Set Up OneDrive the Right Way (Step by Step)

These steps tighten OneDrive to the fullest protection it can offer, without pretending it is a full backup.

Step 1: Enable Known Folder Move

Open the OneDrive client, click the gear icon, choose Settings, and under Sync and backup, select Manage backup. Toggle on Desktop, Documents, Pictures, and (if available) Music and Videos. The steps are mirrored in Microsoft’s KFM setup guide.

The consequence of skipping this step is that your most important folders stay local-only, and a dead laptop takes them with it.

For example, Kevin enabled KFM on day one of his new job. When his laptop was stolen from a coffee shop, IT issued a new machine and he was back to work in 90 minutes.

A common misconception is that KFM is enabled automatically. It is not for most personal accounts, and it must be deployed via Group Policy or Intune in business tenants.

Step 2: Turn On Camera Upload

Install the OneDrive mobile app, sign in, tap your profile, and enable Camera Upload. Choose whether to include videos and whether to upload only on Wi-Fi.

The consequence of skipping this is that every phone loss equals photo loss, which for most users is the single most painful kind of data loss.

For example, Sofia dropped her phone in the ocean. Every photo was already in OneDrive, and she restored them to a new phone at the hotel that night.

A common misconception is that iCloud or Google Photos will sync into OneDrive. They do not, and each platform needs its own upload toggle.

Step 3: Turn On Multi-Factor Authentication

Go to account.microsoft.com/security and enable Two-step verification or pair with the Microsoft Authenticator app.

The consequence of skipping MFA is account takeover, and a compromised OneDrive account is a catastrophic data event.

For example, Derek had MFA off and fell for a phishing email. The attacker emptied his OneDrive and deleted the Recycle Bin. Without an independent backup, most of the files were gone forever.

A common misconception is that a strong password is enough. Password reuse and phishing defeat passwords alone, which is why CISA strongly recommends phishing-resistant MFA.

Step 4: Add a True Third-Party Backup

Subscribe to a backup service that supports Microsoft 365, such as Veeam Backup for Microsoft 365, AvePoint Cloud Backup, or Barracuda Cloud-to-Cloud Backup. For personal use, add Backblaze Personal Backup.

The consequence of skipping this step is that your 3-2-1 strategy has only two copies, both linked through sync, and a single bad event can wipe both.

For example, Marcus (from the earlier example) recovered a deleted employee’s full OneDrive in under an hour because Veeam held an immutable copy.

A common misconception is that Microsoft 365 Advanced eDiscovery is a backup. It is a legal-hold tool, and it is not designed or priced for routine file restores.

Step 5: Configure Retention Policies

Administrators should open Microsoft Purview and set retention policies that match legal and business needs, not defaults.

The consequence of default retention is that regulated data gets purged before the legal retention window ends, triggering compliance violations.

For example, a CPA firm set a seven-year retention policy to meet IRS and SOX expectations, and it survived an audit cleanly two years later.

A common misconception is that retention and backup are the same. Retention prevents deletion; backup lets you restore earlier versions.

Key Entities to Know

The OneDrive ecosystem pulls together several interlocking players. Knowing each one makes the whole picture clearer.

• Microsoft Corporation operates OneDrive under the Microsoft Services Agreement and the Microsoft 365 Online Service Terms.
• Microsoft Purview is the governance and retention console that controls how long Microsoft 365 data lives before purge, detailed in the Purview documentation.
• CISA (Cybersecurity and Infrastructure Security Agency) publishes the federal backup and ransomware guidance that most U.S. companies treat as the floor, through CISA StopRansomware resources.
• NIST provides the Cybersecurity Framework and SP 800-34 contingency planning, which define what backup actually means under federal standards.
• HHS Office for Civil Rights enforces HIPAA, including breach reporting rules that punish inadequate backup strategies.
• Third-party backup vendors like Veeam, Acronis, Barracuda, AvePoint, Druva, and Backblaze fill the gap between OneDrive’s sync and true backup.

Relevant Rulings and Enforcement Actions

A few enforcement actions help anchor why this matters. The OCR settlement with Lifespan Health System in 2020 showed that losing device data without recoverable copies can trigger seven-figure penalties.

The consequence of each of these actions is a written record that regulators expect retrievable, tested backups, not just “the data is in the cloud somewhere.”

Another example: the 2023 FTC action against Drizly tied personal executive liability to inadequate data safeguards, including backup and recovery planning.

A common misconception is that small businesses fly under the regulatory radar. Many of the costliest HIPAA settlements involve small practices, and state attorneys general pursue small firms too.

FAQs

Does OneDrive back up my entire computer?

No. OneDrive only syncs files inside the OneDrive folder and, with Known Folder Move, your Desktop, Documents, Pictures, Music, and Videos. It does not back up programs, system files, drivers, or external drives.

Does OneDrive back up Outlook emails or PST files?

No. Outlook emails live in Exchange Online or local PST files, and OneDrive does not back up either. Storing an open PST in OneDrive can corrupt the file.

Does OneDrive protect me from ransomware?

No. Ransomware encrypts local files that sync straight to the cloud. OneDrive offers a 30-day file restore, but older attacks or delayed detection can exceed that window.

Does OneDrive back up external hard drives?

No. OneDrive only syncs folders on your primary local drive. External USB drives, NAS devices, and mapped network shares are outside its scope entirely.

Does OneDrive count as HIPAA-compliant backup?

No. OneDrive can be HIPAA-eligible under a Microsoft BAA, but alone it does not satisfy the Security Rule’s requirement for retrievable, tested backup copies of ePHI.

Does OneDrive keep deleted files forever?

No. Personal accounts keep deleted items for 30 days, and business accounts for up to 93 days across the first and second-stage recycle bins, then purge permanently.

Does OneDrive back up SharePoint and Teams data?

No. OneDrive, SharePoint, and Teams have separate retention policies, and OneDrive does not extend coverage across those services. Dedicated Microsoft 365 backup tools fill the gap.

Does OneDrive replace Backblaze, Carbonite, or Acronis?

No. OneDrive is sync-and-share with limited versioning. True backup tools keep isolated, versioned, often immutable copies that survive ransomware and mass deletion.

Does OneDrive have unlimited version history?

No. OneDrive keeps up to 500 versions for up to 30 days on most file types. Beyond that window, older versions are generally gone.

Does OneDrive back up a deleted employee’s files automatically?

No. When a Microsoft 365 license is removed, the OneDrive enters a 30-day retention window by default and is then purged unless IT extends retention or transfers files first.

Does OneDrive satisfy the 3-2-1 backup rule on its own?

No. OneDrive is one copy in one cloud. The 3-2-1 rule requires three copies on two media with one offsite, which means at least one additional independent backup layer.

Does OneDrive back up my phone’s WhatsApp or iMessage history?

No. Camera Upload only grabs the default camera roll. Messaging apps use their own backup systems, and OneDrive does not reach into them without manual configuration.