How long does OneDrive keep deleted files?

For work or school accounts, the recycle bin usually keeps items for up to 93 days. Personal accounts usually keep them for 30 days. Check Microsoft's current guidance, as settings and limits can change.

Can OneDrive undo a ransomware attack?

Often it can help. Files Restore can roll a OneDrive back to an earlier point in the last 30 days. That depends on the account still being in your control. A separate backup is your fallback if it is not.

What happens to a leaver's OneDrive?

When you delete a user in Microsoft 365, their OneDrive is kept for a set period and then removed. The default is 30 days unless your admin changed it. Move what you need before you delete the account.

Do I need a separate backup if I already pay for Microsoft 365?

For most businesses, yes. Microsoft keeps the service running. Keeping your own copy of your data is still your job. A separate backup, tested now and then, covers the gaps.

Is OneDrive a backup? What UK SME owners need to know (2026)

OneDrive keeps your files in sync. That is useful. It is not the same as a backup. Here is what Microsoft 365 already keeps, where the gaps are, and a simple plan for owners with no IT team.

Ask most small business owners where their files are backed up and you hear the same answer. "It's all in OneDrive."

That answer is half right. OneDrive keeps copies of your files in Microsoft's cloud. If a laptop dies, you sign in on a new one and your files come back. That is a big step up from files on one hard drive.

But OneDrive is a sync service. It is built to keep every device the same. A backup is built to keep an older, separate copy you can go back to. Those are different jobs.

This guide is for UK owner-managers with roughly 5 to 50 staff and no IT team. It explains the difference in plain English and gives you a short plan. It reduces risk. It does not guarantee you will never lose a file.

Sync and backup are different jobs

Sync copies every change everywhere, fast. Edit a file on your laptop and the change appears on your phone and in the cloud. Delete it on one device and it disappears on all of them.

Backup takes a copy at a point in time and keeps it apart from the live files. If the live files go wrong, the backup is still there as it was.

So sync protects you from a broken laptop. It does not, on its own, protect you from a mistake, a bad actor, or a lost account. Those spread through sync just as quickly as good changes do.

What Microsoft 365 already keeps for you

To be fair to Microsoft, OneDrive and SharePoint have real safety nets. Many owners never switch them on or know where to find them.

Recycle bin. Deleted files go here first. For work or school accounts, items are usually kept for up to 93 days across the first and second-stage recycle bins.
Version history. OneDrive and SharePoint keep earlier versions of Office files and most other files. You can open an older version and restore it.
Files Restore. In OneDrive for work or school, you can roll the whole OneDrive back to a point in the last 30 days. This is the tool to try after a mass delete or ransomware.
Leaver retention. When you delete a user, their OneDrive is kept for a period before it is removed. The default is 30 days unless your admin changed it.

These are good. Check the exact limits in Microsoft's current help pages, as they can change. The point is that they are all time-limited, and they all live inside the same Microsoft 365 tenant as your live files.

Where the gaps are

Here are the real-world ways small businesses lose files even with OneDrive switched on.

1. Nobody noticed in time

A folder was deleted in March. Someone needs it in September. The recycle bin and Files Restore windows have long passed. Without a separate backup, it is gone.

2. A leaver's account was deleted

A staff member leaves. The account is removed to save a licence. Thirty days later their OneDrive goes with it, including client files they never moved to a shared folder.

3. Ransomware or a bad sync

Ransomware scrambles files on a laptop. OneDrive dutifully syncs the scrambled versions to the cloud. Files Restore can often roll this back, if you act within 30 days and still control the account.

4. A compromised or locked account

If a criminal takes over an admin account, they can delete files and empty recycle bins. If Microsoft suspends your tenant, or a billing problem locks you out, every safety net sits behind the same locked door.

5. Files that were never in OneDrive

Not everything is synced. Files saved to the C: drive outside Desktop, Documents, and Pictures. Accounting data in a local app. Files on a USB stick or a NAS. Email attachments only in a mailbox. OneDrive only protects what it actually syncs.

None of these are rare. They are the stories IT support teams hear every week.

Who is responsible for your data?

Microsoft runs the service. It keeps its data centres up, its hardware working, and its copies of the platform safe. It works hard at that.

Your data inside the service is a different matter. Deciding what to keep, for how long, and getting it back after a mistake is largely your job. Microsoft's own terms advise customers to back up their content. Many cloud providers take the same view.

If your cyber insurer or a client security questionnaire asks "Do you have backups?", OneDrive sync on its own may not count. Check the wording. They often ask about separate, tested backups.

A simple plan for owners

You do not need to become an IT expert. Work through these in order.

This week: use what you already pay for

Check that staff Desktop, Documents, and Pictures folders sync to OneDrive. Microsoft calls this Known Folder Move. Ask your IT provider or check each laptop's OneDrive settings.
Move shared business files into SharePoint or Teams, not one person's OneDrive.
Practise one restore. Delete a test file, then get it back from the recycle bin. Restore an older version of a document. Note how long it took.
Find where Files Restore lives in OneDrive settings, so you are not hunting for it on a bad day.

This month: add a separate backup

Choose a backup that copies Microsoft 365 data (OneDrive, SharePoint, Exchange, and Teams) to a separate place. Microsoft sells a backup add-on, and many independent vendors offer Microsoft 365 backup.
Look for: automatic daily copies, retention of at least a year, storage outside your Microsoft 365 tenant, and simple restore of a single file.
Keep the backup's admin login separate from your everyday Microsoft 365 login, with its own strong password and MFA.
Write down who can restore, and how. One page is enough.

Every leaver: a short checklist

Shared files moved to SharePoint or Teams before the account is removed
OneDrive contents reviewed with the line manager
Ownership of the OneDrive transferred, or the files exported, if needed
Account deleted only after the files are safe
Leaver date noted, so you know when the retention window ends

Every quarter: test a restore

A backup you have never restored from is a hope, not a plan. Once a quarter, restore one real file from the backup and check it opens. Our backup and ransomware restore test guide walks you through it.

When file-recovery software helps

Sometimes the file you need was never in OneDrive. It sat on a laptop's local drive, or on a USB stick, and it was deleted. If you still have that device, file-recovery software can sometimes get it back.

Stop using the drive straight away. Every new file saved can overwrite the deleted data. Then run recovery from a different drive if you can.

It is a last resort, not a plan. Try the OneDrive recycle bin, version history, Files Restore, and your backup first.

Quick checklist

Copy this into a note the owner can see.

Desktop, Documents, and Pictures sync to OneDrive on every staff laptop
Shared business files live in SharePoint or Teams, not personal OneDrives
One test restore done from the recycle bin and from version history
Files Restore location known and written down
Separate Microsoft 365 backup in place, stored outside your tenant
Backup admin login separate, with MFA
Leaver checklist used before any account is deleted
Quarterly restore test booked in the calendar
Admin accounts protected with MFA, see MFA for Microsoft 365 beginners

FAQ

Is OneDrive a backup?: Not on its own. It syncs files, so a delete or a scrambled file on one device can reach every device. It has useful safety nets, but they are time-limited and live in the same account.
How long does OneDrive keep deleted files?: For work or school accounts, the recycle bin usually keeps items for up to 93 days. Personal accounts usually keep them for 30 days. Check Microsoft's current guidance, as settings and limits can change.
Can OneDrive undo a ransomware attack?: Often it can help. Files Restore can roll a OneDrive back to an earlier point in the last 30 days. That depends on the account still being in your control. A separate backup is your fallback if it is not.
What happens to a leaver's OneDrive?: When you delete a user in Microsoft 365, their OneDrive is kept for a set period and then removed. The default is 30 days unless your admin changed it. Move what you need before you delete the account.
Do I need a separate backup if I already pay for Microsoft 365?: For most businesses, yes. Microsoft keeps the service running. Keeping your own copy of your data is still your job. A separate backup, tested now and then, covers the gaps.

Bottom line

OneDrive is a good place to keep work files. It protects you from a broken laptop and gives you short-term safety nets. It is not a backup on its own. Use the recycle bin, version history, and Files Restore you already pay for. Then add a separate, tested backup that keeps copies outside your Microsoft 365 account for longer than a few weeks. Do one restore test this week. It is the cheapest insurance you will buy.