OneDrive detects mass-encryption events, alerts you, and offers a guided restore, but it does not stop ransomware from reaching your files. Enable multi-factor authentication and make sure every device is clean before you restore anything. Time matters: File Restore reaches back 30 days, the recycle bin holds items for 93 days, and at least 500 versions of each file are retained.
TL;DR:
- A full OneDrive restore sends files created after the selected recovery point to the Recycle Bin, and it does not restore photo albums.
- Use version history for a few damaged files; slow moving infections can outlast the full account recovery window and force file by file restoration.
- Admins should scope affected accounts, revoke suspicious sessions, app consents, and tokens, then reset devices when malware is unknown or administrator credentials were exposed.
- Run Controlled Folder Access and Attack Surface Reduction rules in Audit mode first, review false positives, then check Defender and Intune licensing before enforcement.
- Use independent backups for longer retention, tenant level protection, or fast bulk recovery, and test restores with identity services included in the recovery plan.
Table of Contents
- How does OneDrive detect ransomware and guide your recovery?
- Which built-in recovery tools and timelines can you rely on?
- What prevention controls should you enable before an attack?
- How should admins respond when a OneDrive ransomware alert fires?
- When is native OneDrive recovery enough, and when do you need more?
- Why trust this guide?
- What would we do first if we were you?
- How can we help you get ready for ransomware?
- FAQ
- Sources
How does OneDrive detect ransomware and guide your recovery?
Microsoft watches for mass-encryption patterns in OneDrive. When it sees one, it notifies the account owner and opens a guided recovery flow. The key point is that this is a notification and recovery helper, not a barrier. It tells you something went wrong and walks you back to a clean state. It does not promise the attack never lands.
The guided workflow follows three steps:
- Confirm the infection. Review the alert and identify which files were encrypted and which devices were syncing at the time.
- Clean every device. Scan or reset each computer connected to the account. Skip this step and a reconnected infected device will encrypt your restored files all over again.
- Restore OneDrive to a chosen point in time. Pick a date before the encryption began, using the activity chart as your guide.
The restore itself runs through the Restore your OneDrive feature, which lets Microsoft 365 subscribers undo file and folder changes from the last 30 days. Files created after your chosen restore point are sent to the Recycle Bin, so expect some recent legitimate work to need recovering separately. Photo albums are not restored.
Set expectations accordingly. Detection gives you a head start, but your recovery is only as good as your device hygiene. An admin who restores before cleaning has simply scheduled a second incident.
Which built-in recovery tools and timelines can you rely on?
OneDrive layers several recovery mechanisms, and each has its own window. Knowing them in advance lets you decide quickly instead of improvising under pressure.
- Version history: OneDrive keeps at least 500 versions of a file by default, and since version history expanded to all file types this covers everything from spreadsheets to design files. Use it when only a handful of files were hit.
- Recycle bin: Deleted items stay for 93 days. In some scenarios Microsoft can recover content for an additional 14 days beyond that, so a missed deadline is not always final.
- File Restore: Users and admins can self-serve a restore for the last 30 days, with an activity chart to find the moment before damage began.
- Tenant rollback: In some mass-attack scenarios, Microsoft can roll a tenant back to a previous point in time for up to 14 days.
- Preservation Hold library: Where retention is configured, earlier versions are kept as separate retained items, which also helps investigators reconstruct what happened.
SharePoint and OneDrive protections include versioning of at least 500 versions, a 93-day recycle bin plus a possible 14-day Microsoft recovery window, and File Restore for the last 30 days. The shortest of these windows, 30 days, is the one that governs a full-account restore.
In practice, the 30-day limit is the number to remember. A slow-burn infection that sits quietly for an extended period before encrypting can outrun File Restore, leaving you to dig through version history file by file.
What prevention controls should you enable before an attack?
Recovery tools are a safety net. Prevention raises the cost of every attack. Microsoft recommends a multi-layered defense because cloud sync can help malware propagate across devices, and ransomware needs local permission to encrypt synced folders. Work through these in order:
- Enforce multi-factor authentication everywhere. Stolen credentials remain the cheapest way into a tenant. Add conditional access to challenge high-risk sign-ins. Our walkthrough on MFA for Microsoft 365 covers rollout without locking out your own staff.
- Turn on Controlled Folder Access. Controlled Folder Access blocks untrusted apps from modifying protected folders such as Documents, Pictures and Desktop, and you can add more paths. It runs in Audit mode, which only logs, or Block mode, which enforces. Start in Audit.
- Deploy Attack Surface Reduction rules. ASR rules target risky software behaviors and are best deployed through Microsoft Intune or Configuration Manager. Treat exclusions as a managed program, because Group Policy and MDM precedence rules decide which setting wins.
- Limit exfiltration with DLP and cloud app controls. Microsoft Purview DLP and Defender for Cloud Apps help block risky downloads and unusual data movement.
- Roll out in phases. Test Controlled Folder Access and ASR in Audit, review what would have been blocked, then enforce. Confirm your licensing covers Defender and Intune before you plan the timeline.
Pro Tip: Review Audit mode logs over a representative period before switching to Block. Month-end accounting tools and legacy line-of-business apps are the usual false positives.
Also tighten sharing. Restrict who can share externally, review broad “anyone with the link” settings, and give users the minimum permissions they need. A compromised account can only encrypt what it can reach.
How should admins respond when a OneDrive ransomware alert fires?
Speed matters, but order matters more. Follow this sequence:
- Detect and scope. Check the OneDrive activity chart and activity feed, then use Microsoft Defender advanced hunting to find affected accounts and related alerts.
- Isolate. Disable or restrict affected accounts and devices, revoke suspicious app consents and API tokens, and consider revoking active sessions.
- Clean or reset every device. No restore happens before this step.
- Restore. Use File Restore for broad damage or version history for a few files.
- Validate and monitor. Open sample files, confirm nothing re-encrypts, and watch alerts for several days.
- Document. Record the timeline, root cause and lessons learned.
Deciding between cleaning and resetting comes down to confidence:
- Clean with a full scan only when you can identify the malware, confirm removal and see no persistence mechanisms.
- Reset or reimage when the strain is unknown, admin credentials were exposed, or the device holds nothing that is not already in the cloud.
- Escalate to managed detection and response, or open a Microsoft support case, when the attack spans many accounts, touches identity infrastructure, or you suspect a tenant-wide rollback is needed.
A written plan makes all of this faster. Our one-page incident response plan is a good starting template, and the NIST ransomware risk management profile offers a framework you can adapt into a ransomware playbook.
When is native OneDrive recovery enough, and when do you need more?
Native recovery suits small teams with short recovery needs. It covers accidental deletion, a contained infection caught within days, and modest data volumes. It starts to strain with long-term retention, regulatory obligations, and large-scale rapid restores where many users need data back at once.
Independent backups close those gaps:
- Immutability: Copies that attackers cannot alter or delete, even with stolen admin credentials. See our guide to immutable backups and ransomware.
- Longer retention: Recovery points beyond the 30-day and 93-day windows.
- Tenant independence: A copy that survives a compromised or misconfigured tenant.
- Faster bulk restores: Solutions built on the Microsoft 365 Backup Storage platform are designed for restore speed at scale.
Whatever you choose, test restores on a schedule, and include Active Directory and identity in the recovery plan, because files are useless if nobody can sign in. Our write-up on the backup rule shows how to structure copies.
Why trust this guide?
We run cybersecurity-first managed IT with continuous support and experience in regulated industries, so these steps come from daily practice. The guidance here is grounded in Microsoft technical documentation and NIST and CISA frameworks. If you want an assessment or help with managed backups, our Microsoft 365 team can help.
What would we do first if we were you?
We would start with three quick wins: enforce MFA, run endpoint scans with current patching, and confirm versioning and backups actually work. Protect identities and endpoints first, then layer in Controlled Folder Access, ASR rules and restore testing. Above all, schedule a real restore test. A backup you have never restored is a hope, not a plan.
— 247techify Team
How can we help you get ready for ransomware?
We pair ongoing support with managed detection and response, automated cloud backup and Microsoft 365 management. By our own measure, our average response time is under 30 minutes. The goal is simple: validated restores, coordinated incident response and faster recovery when something goes wrong. Request a discovery call or a backup assessment through our cybersecurity services page and we will review your setup with you.
FAQ
Does Windows Defender defend against ransomware?
Yes, in layers. Microsoft Defender includes Controlled Folder Access and Attack Surface Reduction rules that block untrusted apps from modifying protected folders. These features need to be enabled and tuned, so they do not protect you by default alone.
Is my OneDrive secure?
OneDrive includes versioning, a recycle bin and File Restore, but account security depends on your setup. Turn on multi-factor authentication and keep devices clean. Without those, a stolen password undermines the built-in protections.
Does ransomware encrypt all of your files?
Not necessarily. It encrypts what the infected account or device can reach, which includes OneDrive-synced folders. Limiting permissions and sharing reduces what an attacker can touch.
Which is safer, iCloud or OneDrive?
It depends on how each is configured and managed. For Microsoft 365 environments, OneDrive offers admin controls, retention settings and integration with Defender that most organizations can use to build a stronger, auditable defense.
Sources
- How to detect ransomware and recover files using OneDrive | Microsoft Support
- Ransomware protection in Microsoft 365 - Microsoft Service Assurance | Microsoft Learn
- Learn
- Learn