OneDrive is a sync service, not a backup. If ransomware encrypts your files those encrypted versions sync to OneDrive too, and your email, Teams data and SharePoint sites are not protected by it at all.
One of the most common things we hear from business owners is that they do not need a backup because they have OneDrive. It is an understandable assumption. Your files are in the cloud, they sync automatically and you can access them from any device. That sounds like a backup.
It is not. And the difference matters more than most people realise.
What OneDrive actually does
OneDrive is a file synchronisation service. It keeps a copy of your files in Microsoft's cloud and syncs changes between your devices in real time. If you edit a document on your laptop, the change appears on your phone and in the browser version within seconds. If your laptop is lost or stolen, your files are still in the cloud.
This is useful and it solves a real problem. But synchronisation and backup are fundamentally different things, and confusing the two can leave your business dangerously exposed.
Why sync is not backup
The core issue with sync is that it mirrors everything, including mistakes and damage.
If you accidentally delete a file, OneDrive deletes it everywhere. If you overwrite a document with the wrong content, the overwritten version syncs to all your devices. If ransomware encrypts your files, those encrypted files sync to OneDrive too, replacing the good copies with useless ones.
OneDrive does have a recycle bin that keeps deleted files for 93 days and version history that goes back 30 days. These are helpful for recovering from simple mistakes. But they have limits and they do not cover everything your business depends on.
What OneDrive does not protect
Even if OneDrive's built-in recovery features work perfectly for your files, there is a long list of business data that OneDrive does not touch at all.
Your Outlook email, calendar and contacts are not backed up by OneDrive. If your mailbox is compromised, if emails are deleted by an attacker or if your account is corrupted, OneDrive will not help you recover any of it.
Your Microsoft Teams conversations, channels and shared files live in SharePoint, not OneDrive. If a team is accidentally deleted or data is lost from a channel, OneDrive's recovery features do not apply.
Your SharePoint sites and shared document libraries are separate from individual OneDrive storage. Data loss in SharePoint requires its own backup strategy.
Any data in third party applications your business uses, your accounting software, your CRM, your project management tools, is completely outside OneDrive's scope.
If your business relies on any of these, and every business does, OneDrive alone leaves significant gaps in your data protection.
The ransomware problem
Ransomware is where the sync versus backup distinction becomes critical. Modern ransomware does not just encrypt files on one computer. It spreads across the network and reaches anything the infected device has access to, including OneDrive.
When encrypted files sync to OneDrive, the cloud copies are replaced with the encrypted versions. OneDrive's version history may allow you to roll back individual files, but restoring hundreds or thousands of files one at a time is impractical. And if the ransomware has been present on your system for longer than OneDrive's 30 day version history window, even that recovery option may not go back far enough.
A proper backup solution stores copies of your data in a separate, isolated location that ransomware cannot reach. If the worst happens, you restore from the backup and you are back in business. Without that separate copy, you are negotiating with criminals or starting from scratch.
What a proper backup looks like
A business backup solution does several things that OneDrive cannot.
It backs up your entire Microsoft 365 environment including email, OneDrive, SharePoint and Teams. Not just files, everything.
It stores backups in a separate location that is isolated from your production environment. If ransomware hits your network, the backups are untouched.
It retains data for as long as you need it. Not 30 days or 93 days, but months or years depending on your requirements and compliance obligations.
It allows you to restore quickly. Not file by file, but entire mailboxes, entire SharePoint sites or complete OneDrive accounts in one operation.
It is monitored continuously so someone knows immediately if a backup fails, rather than discovering the problem the day you need to restore.
And it is tested regularly to confirm that the data can actually be recovered when needed. A backup that has never been tested is not a backup at all.
Microsoft's own position on this
Microsoft's own service agreement makes their position clear. They recommend that you back up your data stored in Microsoft 365 using a third party service. Microsoft provides the infrastructure and availability of the platform, but responsibility for protecting the data stored in it sits with you.
This is not a technicality. It is a deliberate design decision. Microsoft ensures their servers stay online. Making sure your data is recoverable if something goes wrong on your end is your responsibility.
The cost of getting this wrong
Losing business data is expensive in ways that go beyond the obvious. Recreating lost documents and records takes time your team should be spending on real work. Lost email history means lost context on client relationships and projects. Compliance failures under POPIA carry fines of up to ten million rand. And the reputational damage of telling clients their data was lost because your business did not have proper backups is difficult to recover from.
The cost of a proper backup solution is a fraction of any of these consequences. For most small businesses it is a predictable monthly expense that pays for itself the moment anything goes wrong.
The bottom line
OneDrive is a good tool and every business using Microsoft 365 should use it. But it is not a backup. It is a sync service with limited recovery features that do not cover your email, your Teams data, your SharePoint sites or any of the other systems your business depends on.
If your current answer to the question of whether your data is backed up is that you have OneDrive, it is worth having a proper conversation about what would actually happen if you lost data tomorrow. At Recloud we set up and manage backup solutions for Cape Town businesses that cover your entire Microsoft 365 environment and give you the ability to recover quickly from anything, whether it is an accidental deletion, a ransomware attack or a departing employee who takes data with them. Get in touch and we will show you where the gaps are.