OneDrive stores your files in the cloud and keeps them in sync across your devices. For most small businesses, that feels like protection. It is not. The difference between backup vs sync in OneDrive is a small business blind spot that rarely surfaces until files are already gone.
This post is for owners and office managers who rely on Microsoft 365 and want to know whether their files are actually protected. We cover how sync and backup differ, three situations where sync makes things worse, what Microsoft actually retains, and what a real backup layer looks like.
How File Sync Works
OneDrive is a sync tool. It copies your files to Microsoft's servers and then mirrors those files to every device signed into your account. That is useful for accessing files from anywhere and for recovering from a lost or stolen laptop.
The key word is "mirrors." Sync mirrors whatever is in the folder right now. If you delete a file, that deletion mirrors to the cloud and to every connected device within seconds. If ransomware encrypts a file on your laptop, the encrypted version mirrors to the cloud and overwrites the previous copy.
Sync has no memory of what a file looked like yesterday. It knows only the current state. A common mistake is assuming that because files live in the cloud, they are protected from accidents and attacks. The cloud location does not help if the event that caused the problem also changed the files before sync ran.
OneDrive Backup vs Sync: Why the Gap Matters
A backup makes a separate, independent copy of your data at a point in time, then keeps multiple versions. When you need to recover, you pick the version from before the incident and restore it. The backup copy does not change when your live data changes.
That independence is what makes backup useful against ransomware. CISA warns that many ransomware variants attempt to find and delete accessible backups to make restoration impossible. A sync connection to OneDrive is accessible. A proper backup system stores copies in a location the compromised device cannot reach.
CISA's Cyber Essentials guidance recommends employing a backup solution that automatically and continuously backs up critical data and system configurations. The key difference is that backup stores an independent copy that ransomware, human error, and software failures cannot reach through the same path as your live data. If sync is your only protection, all three of those events lead to the same outcome: no clean version to restore.
Three Situations Where Sync Makes Things Worse
Accidental deletion is the most common. An employee removes a folder thinking it is a duplicate. OneDrive mirrors that deletion everywhere within seconds. The file is gone from every device and from the cloud at the same time, because they are all the same copy.
Ransomware is the most dangerous. The malware encrypts files on a local machine. OneDrive syncs the encrypted versions to the cloud and to any other connected device. Ransomware can wipe out your backups when those copies are reachable from the infected machine.
Silent corruption is the hardest to catch. An accounting file or database becomes corrupted from a failed save or a software bug. The corrupted version syncs everywhere. If version history is shallow or was not enabled, the last clean version may already be overwritten. By the time someone notices, the clean copy is gone. A solid disaster recovery plan accounts for all three of these scenarios before they happen.
What Microsoft Actually Retains
Microsoft includes some protection features, but they are not backup. OneDrive keeps deleted files in a recycle bin and maintains version history for files. The depth of version history depends on your subscription plan and your settings. These features help with small, quick mistakes but have hard limits.
Microsoft 365 includes retention policies and retention labels for records management, configured through the Microsoft Purview portal. OneDrive is a supported workload, meaning you can build rules to automatically retain and then delete content based on age or inactivity. These tools are designed for compliance, not recovery. They do not give you a restore point from before an incident.
One timing detail matters. After you submit a retention policy, it can take up to seven days for the retention settings to be applied to content. During that window, new files are not yet covered. Microsoft's built-in tools fill some gaps, but they are not designed to restore a known-good state from before an attack or accident. That is what a true backup does.
What a Real Backup Layer for Microsoft 365 Looks Like
A real backup for a Microsoft 365 environment pulls your data directly from Microsoft's servers on a schedule, independent of the sync client. It retains deleted files and old versions in its own storage, separate from OneDrive's recycle bin. And it keeps at least one copy in a location that your primary environment cannot reach.
CISA's guidance calls for regular automated backups with protections including offline copies. CISA advises maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity. Offline means the backup is not reachable by ransomware on your network. Encrypted means the data is protected if the storage media is ever lost or stolen.
A capable backup solution for Microsoft 365 should cover Exchange email, SharePoint sites, Teams data, and OneDrive as separate workloads, not just one. Many businesses find gaps only after they need to recover something. Ask any vendor whether their product uses immutable storage, meaning backups cannot be changed or deleted during the retention window even by an admin. Some businesses host offline copies in a separate cloud infrastructure account that sits outside their main Microsoft environment. Talk to your managed IT provider about which workloads are covered and how long versions are retained.
How to Verify Your Protection Level Today
Work through this list before you talk to a vendor. Knowing your current state helps you ask the right questions and spot gaps before an incident forces the issue.
- Open the Microsoft Purview portal and check whether retention policies are set for OneDrive. Note the scope and how long they retain files.
- Check OneDrive version history settings. Find out how many versions are stored and whether version history is active for all file types.
- Look at the OneDrive recycle bin and find out how long deleted files stay there under your subscription plan.
- Ask your IT provider whether the backup solution pulls directly from Microsoft's servers or relies on the sync client. A backup that depends on the sync client can fail in the same event that hits your live data.
- Confirm whether the backup stores offline or immutable copies, ones separated from your Microsoft 365 environment and out of reach of ransomware.
- Schedule a restore test. Pick a folder, restore it from a date before a known change, and confirm the files are correct and complete.
CISA's small business guidance notes that organizations hit by ransomware often had no backups or had incomplete or damaged backups. A backup you have never tested is just a guess. A common mistake is running the first restore test only after a real incident, when it is too late to fix a gap you did not know existed.
Book a free 30-minute call with Joshua to review what you have in place and find the right backup solution for your business. OneDrive is a great sync tool. The goal is to make sure it is not the only protection your files have.
