OneDrive is a sync and file-sharing tool, not a backup. It keeps copies of your files across devices and the cloud, and it includes limited version history, but it will faithfully sync deletions, corruption and ransomware encryption to every connected device. A real backup is a separate, immutable copy of your data kept on its own schedule and retention rules, independent of the live, working copy.
Sync keeps files the same everywhere — that's the problem
OneDrive's whole job is to make sure the file on your laptop, your phone, and the cloud all match. That's great for collaboration. It's not great for data protection, because if a file is deleted, overwritten, or encrypted by ransomware on one device, OneDrive dutifully syncs that change everywhere else. The "backup" you were counting on just disappeared along with the original.
Backup works on a different principle: it keeps older, separate copies of your data on its own schedule, so you can go back in time to a point before the problem happened. Sync and backup solve different problems, and a lot of businesses only have one of them covered.
Version history exists, but it has limits
Microsoft 365 does include version history and a recycle bin, and for a quick "I overwrote the wrong version" moment, it can genuinely save you. But there are practical limits worth knowing:
- Recycle bins and version history have retention windows, after which older versions age out
- Version history is per-file and per-library, which makes recovering an entire folder structure or a whole mailbox slow and manual
- If an account is deleted or a subscription lapses, that history can be affected
- None of it is designed for recovering dozens or hundreds of files at once after a widescale incident
It's a safety net for small, everyday mistakes. It isn't built to be your disaster recovery plan.
Ransomware doesn't care that your files are in the cloud
A common misconception is that because files live in Microsoft 365, they're somehow immune to ransomware. They're not. If a workstation is compromised and ransomware starts encrypting local files, the encrypted versions sync straight up to OneDrive and SharePoint, right alongside the clean versions in version history. Recovering from that means knowing exactly which version to roll back to, across every affected file and folder, under pressure, during an incident. Having a separate backup with clear restore points removes that guesswork.
Accidental deletion is more common than ransomware
Most data loss isn't dramatic. An employee deletes the wrong folder, a sync conflict overwrites a shared file, someone leaves the company and their account (and its files) gets cleaned up faster than expected. These everyday accidents are far more likely to hit a GTA small business than a headline-grabbing cyberattack, and they're exactly the kind of thing that a real backup, with longer retention and full restore options, is designed to handle calmly.
What a real backup actually includes
A proper backup for a Microsoft 365 environment generally includes a few things OneDrive alone doesn't provide:
- Backups stored independently of the live Microsoft 365 tenant, not just inside it
- Defined retention periods you control, rather than relying on default recycle bin limits
- Coverage across mailboxes, SharePoint, Teams, and OneDrive, not just one of them
- The ability to restore a single file, a full folder, or an entire account
- Regular verification that backups are actually completing and restorable
This is the gap that solutions like Tejas Backup are built to close, with data stored in Canada, which also helps with data residency questions that come up around privacy obligations.
A simple way to check where you stand
If you're not sure what's covered right now, ask a few plain questions: Do we have anything other than OneDrive's recycle bin protecting our files? How far back can we actually restore if needed? Who would know how to do that restore, and how long would it take to recover a full mailbox or shared drive? If the honest answer is "we're not sure," that's worth addressing before it's tested by an actual incident rather than during one.
It's also worth reviewing this alongside your broader Microsoft 365 setup — permissions, sharing settings and account security all play into how resilient your environment is. Our Microsoft 365 & Cloud Services page covers how we help businesses configure and manage this properly.
Where Tejas Solutions fits in
We work with small and mid-sized businesses across Brampton, Mississauga, Toronto and the rest of the GTA to set up backup and disaster recovery that actually matches how they use Microsoft 365 day to day. That means separate, verified backups with Canadian storage, clear retention rules, and a restore process that's been tested before it's ever needed. You can see the full approach on our Backup & Disaster Recovery page, or look at Tejas Backup directly if you just want to know what a proper backup setup looks like for your business.
Frequently asked questions
Does Microsoft back up my OneDrive files for me?
Microsoft provides infrastructure redundancy to protect against their own hardware failures, plus version history and a recycle bin for user-level mistakes. That's different from a business backup with independent, long-term, restorable copies of your data.
How long does OneDrive keep deleted files?
Deleted files sit in the recycle bin for a limited time before being permanently removed, and version history also has its own retention limits. Exact windows can change, so it's worth checking current settings rather than assuming indefinite retention.
Can ransomware affect files stored in Microsoft 365?
Yes. If a connected device is infected, encrypted files can sync up to OneDrive or SharePoint just like any other change, which is why a separate backup with clear restore points matters.
What's the difference between sync and backup?
Sync keeps the same version of a file consistent across devices in real time, including deletions and bad changes. Backup keeps separate, point-in-time copies so you can recover an earlier, unaffected version when something goes wrong.
Do I need backup if I already pay for Microsoft 365?
Microsoft 365 licensing includes basic recovery tools, but most businesses add a dedicated backup solution for longer retention, full-tenant restore capability, and peace of mind beyond the default settings.