Is OneDrive a Backup? What Microsoft Documents (2026)

OneDrive keeps your files available. Whether it also keeps them recoverable depends on how far back you need to go.

Quick answer: for a work or school account, OneDrive is mainly a sync and collaboration service with built-in recovery tools, not an independent backup. The tools are useful but time-limited. Microsoft documents a 93-day recycle bin, a 30-day point-in-time restore for a whole OneDrive, and a 14-day Microsoft-side backup that only restores whole site collections. Once a file is past those limits, or has been permanently deleted, Microsoft says it cannot be recovered. If your business needs older versions, a copy that does not depend on one admin account, or a tested route back from ransomware, you need a real backup in addition to OneDrive.

This guide is built from Microsoft's own documentation (sources and the date we checked them are at the end) and separates what Microsoft states from what is our opinion. It is written for owners and IT leads of small and mid-sized businesses. The search data we have for this topic is thin: the closest queries in the exports we used are "managed onedrive backup", "onedrive backup and restore" and a Vietnamese query asking for tools to back up OneDrive data against errors. None is literally "is OneDrive a backup", so treat this article as an answer to a common business question rather than to a measured search volume.

What "backup" means here

Microsoft does not define "backup" in the pages we used, so this definition is ours: a backup is a separate copy of data, kept apart from the system it protects, with enough history to go back to a good state, and a restore that has actually been tested. By that test, a feature that lives inside the same account and the same service is a recovery tool, which is valuable, but is not the same thing.

A sync service copies changes between your devices and the cloud. That is its job. It is our general observation, not a Microsoft quotation, that this also means a deletion or an encrypted file can be copied along with everything else. The recovery tools below exist because of that.

What OneDrive and Microsoft 365 do give you

All of the following comes from Microsoft's documentation for work or school accounts.

The recycle bin. Microsoft says items deleted from a SharePoint site, including OneDrive files, go first to the site recycle bin (the first-stage bin) and then, if someone deletes them from there, to the site collection recycle bin (the second-stage bin). Items are retained for 93 days from the time you delete them from their original location. Microsoft's support page says its recycle-bin guidance also applies to OneDrive for work or school files.

Version history. For a file that still exists, you can restore an earlier version: Microsoft's steps are to right-click the file, select Version history, then select Restore next to the version you want. The selected version becomes current and the previous current version stays in the list. Microsoft also notes that SharePoint versioning settings apply to OneDrive for work or school, so how many versions you can reach depends on those settings, which we did not check.

Restore your OneDrive. Microsoft's Learn documentation describes restoring a OneDrive to any point within the past 30 days. Microsoft's support page says it undoes the activities you select and returns files to the state before the first activity you selected. Files created after the restore point go to your recycle bin.

A short Microsoft-side backup window. Microsoft states that SharePoint Online keeps backups of all content for 14 additional days beyond actual deletion, and that an administrator can ask Microsoft Support for a restore within that window. The limit is stated plainly: restorations from backups can only be done for site collections, not for specific files, lists or libraries.

Leavers' OneDrive. When a user is deleted, Microsoft says the OneDrive is kept for 30 days by default, then held in a deleted state for 93 days, and restoring it after the first period needs a SharePoint Administrator using PowerShell.

For step-by-step instructions for each tool, see our guide to restoring deleted OneDrive files.

Where the built-in tools stop

Reading Microsoft's own limits side by side shows where the gaps are. The facts are Microsoft's; the conclusions about what they mean for a business are ours.

Situation	What Microsoft documents	The gap
A file is deleted and nobody notices for months	Recycle bin keeps items 93 days; after that, or if deleted from the second-stage bin, it is permanently deleted	Anything noticed after 93 days is gone
Someone empties the recycle bin	Items stay in the first-stage bin unless someone deletes or empties it; the second-stage bin can also purge the oldest items if it exceeds its quota	The retention period is a maximum, not a guarantee
Many files change at once	Restore your OneDrive covers the past 30 days; a file permanently deleted from the recycle bin "can never be recovered"	A problem found on day 31 is outside the window
You need one file from an old backup	Microsoft-side backups (14 days) restore only whole site collections	No per-file restore from that route
An employee leaves	30 days by default, then 93 days in a deleted state, restored by PowerShell	If nobody acts in time, the account's files are lost
Ransomware or a malicious admin	The tools above all live inside the same tenant	A copy that shares the same account and admin access shares the same risk (our reasoning)

None of these gaps means the built-in tools are bad. They are designed for the common case: someone deleted a file last week.

Who is responsible for your data?

Microsoft's shared-responsibility documentation says that "for all cloud deployment types, you own your data and identities", and that you are responsible for protecting their security. Its responsibility table lists customer data as the customer's responsibility for software-as-a-service products, and it names Microsoft 365 as an SaaS example. The same page adds a note that the wording is illustrative guidance, not legal conclusions, and does not change any agreement between you and Microsoft, so check your own contract for the legal position.

Microsoft's data-resiliency page describes what the service itself is built to survive. It says data resiliency means "no matter what failures occur within Microsoft 365, critical customer data remains intact and unaffected", and that the service keeps separate copies of customer data in different fault zones. It also says "most data loss results from customer actions", which is why customers are given a graphical way to restore accidentally deleted items themselves.

Our reading of those two pages together: Microsoft protects against its own hardware and software failures, and gives you self-service tools for your mistakes, and those tools have the time limits above. Protection against a deletion, an overwrite or an attack that happens inside your account is something the customer has to plan for. That is our interpretation; Microsoft's pages do not say "OneDrive is not a backup" in those words.

One more relevant line comes from Microsoft's malware documentation: "Protection against malware is a shared responsibility." The same page adds that, beyond detection and cleanup, Microsoft 365 Backup "provides admin-controlled, fast bulk recovery if an attack, ransomware, or otherwise impacts your data."

Microsoft's own backup option

Microsoft 365 Backup is a separate service from the OneDrive recycle bin. According to its overview (page updated 18 August 2026), it can back up all or selected SharePoint sites, OneDrive accounts and Exchange mailboxes. For OneDrive:

• The recovery window is configurable on a backup policy: 3 months, 6 months, 1 year or 2 years, and existing policies default to 1 year.
• Recovery points are every 10 minutes for the two weeks prior, plus weekly snapshots from 2 to 52 weeks prior.
• It restores a whole OneDrive account to an earlier point in time. Microsoft lists restoring individual files via versions as "coming soon".
• Backups are stored in append-only storage, which Microsoft says prevents non-deletion modifications of existing restore-point data.

We did not verify the price, which plans can buy it, or whether the "coming soon" file-level restore has since shipped. Check Microsoft's page before you rely on any of these points. Third-party backup products are the other route. We have not compared them in this article; our older guides on why businesses need Veeam backup for Microsoft 365 and the 3-2-1-1-0 backup rule go further.

What a small business should actually do

This section is our recommendation, not Microsoft's. It is meant to be proportionate: you do not need an enterprise design, but you do need to know what is and is not covered.

1. Write down what is in OneDrive that you cannot afford to lose. Accounting exports, signed contracts, customer files and design masters are different from working drafts.
2. Decide how far back you might need to go. If the honest answer is "more than 30 days" for any of that data, the built-in restore tools are not enough on their own.
3. Keep at least one copy that is not controlled by the same account. The point is that one compromised admin or one mistaken bulk delete cannot reach every copy. This is the idea behind the 3-2-1 rule; see our guide to the 3-2-1-1-0 backup rule.
4. Choose a route: Microsoft 365 Backup, a third-party Microsoft 365 backup product, or a scheduled export to storage you control. We have not compared prices or products here.
5. Test a restore. Restore one non-critical file, and write down how long it took and who did it. A backup that has never been restored is an assumption.
6. Set a leaver routine. Because the clock for a deleted user's OneDrive starts when the account is deleted (Microsoft states that blocking sign-in or removing the licence does not start it), copy what the business needs before you delete the account. See restoring deleted OneDrive files for the details.
7. Name an owner and a date. Who checks that backups are running, and when is the next test?

Frequently asked questions

Is OneDrive a backup?

For a work or school account, it is a sync and collaboration service with recovery tools that have documented time limits (93 days for the recycle bin, 30 days for Restore your OneDrive). We would not call it an independent backup, but that wording is ours; Microsoft's pages describe the tools and their limits without using the word "backup" for OneDrive itself.

Does OneDrive keep a copy if I delete a file?

Yes, for a limited time. Microsoft says deleted items stay in the recycle bin for 93 days from deletion, unless they are removed earlier. After that they are permanently deleted.

Can I get back a file from six months ago?

Not from the recycle bin or Restore your OneDrive, both of which have shorter windows. You would need a backup that covers that period. Microsoft 365 Backup lets you set a recovery window of up to 2 years on a policy.

What if ransomware encrypts my files?

Microsoft's documentation points to Restore your OneDrive (past 30 days) and to Microsoft 365 Backup for admin-controlled bulk recovery after an attack. We did not find, in the pages we used, a statement that tells you ransomware recovery is guaranteed, so test it before you rely on it.

Who is responsible for my Microsoft 365 data?

Microsoft's shared-responsibility page says that for all cloud deployment types you own your data and identities, and lists customer data as the customer's responsibility for SaaS. Read it together with your own agreement with Microsoft; the page says it does not change that agreement.

Do I need backup if I only use OneDrive for a few documents?

It depends on whether losing them would hurt. If you can recreate the files in an afternoon, the built-in tools may be enough. If not, add a backup.

Sources and date checked

The limits and behaviours attributed to Microsoft come from the pages below, opened and checked on 15 October 2026. If anything differs, the original page is the authority:

• Microsoft Learn: Restore deleted items from the site collection recycle bin (SharePoint in Microsoft 365), updated 31 August 2026 (93-day retention, 14-day backups).
• Microsoft Learn: Restore a deleted OneDrive, updated 7 February 2025.
• Microsoft Learn: How SharePoint and OneDrive safeguard your data in the cloud, updated 13 January 2025 (Restore your OneDrive within the past 30 days).
• Microsoft Support: Restore your OneDrive; Restore items in the recycle bin that were deleted from SharePoint or Teams; Restore a previous version of a file stored in OneDrive.
• Microsoft Learn: Shared responsibility in the cloud, updated 24 August 2026.
• Microsoft Learn: Data resiliency in Microsoft 365, updated 29 September 2025.
• Microsoft Learn: Malware protection in Microsoft 365, updated 15 October 2025.
• Microsoft Learn: Overview of Microsoft 365 Backup, updated 18 August 2026.

Not verified in this article: pricing and plan availability of Microsoft 365 Backup; whether file-level restore in Microsoft 365 Backup has since shipped; the default number of file versions kept; the rules for personal Microsoft accounts (this article is about work or school accounts); the Microsoft Services Agreement's backup wording (the page loaded but the relevant section was cut off); and any comparison of third-party backup products. The 30-day Restore your OneDrive figure rests on one sentence on a Learn page that was partly cut off when we fetched it, so confirm it in Microsoft's Restore your OneDrive article. The definition of "backup", the gap table's conclusions, the reading of the two Microsoft pages on responsibility and the seven-step plan are our own opinion, not Microsoft statements.

Next step

If you are not sure what your Microsoft 365 data is actually covered by, or you want a tested backup and a restore you have seen work, contact Vietify or request a free IT assessment. See also our IT security services and Microsoft 365 for business.

Vietify IT Services — practical IT and Microsoft 365 support for businesses in Da Nang. Updated: 15 October 2026.