OneDrive for Business: Sync, Sharing, and Restore

OneDrive for work gives each person 1 TB of cloud storage for their own working files, included with every Microsoft 365 Business plan. Set up properly, it does three useful things: it keeps the Desktop and Documents folders of each computer copied to the cloud (Known Folder Move), it lets a small laptop see every file without storing them all (Files On-Demand), and it lets people undo mistakes with version history and a 93 day recycle bin. It is not a backup, and this guide explains why.

What Is OneDrive For, and What Is It Not For?

OneDrive is the personal side of Microsoft 365 file storage. Each licensed user has their own, and only they can see what is in it until they share something. It is tied to their account.

That last point drives the main rule: OneDrive is for files that belong to a person. Files that belong to the business go in SharePoint or a Teams channel, which are owned by the organization and stay put when someone leaves. We compare the three side by side in our SharePoint guide, so we will not repeat it here.

Good uses for OneDrive: drafts, notes, a working copy before it is ready to share, personal reference material, and the Desktop and Documents folders of a work computer.

Poor uses: the company’s customer folders, accounting records, HR files, or anything a colleague would need if the owner were out sick.

OneDrive for work is also different from the personal OneDrive that comes with a consumer Microsoft account. The work version is managed by your organization: an administrator can set sharing rules, recover files, and control what happens to the content when someone leaves. Some consumer features, including Personal Vault, are only offered on personal plans.

How Does the Sync App Work?

The OneDrive sync app is built into Windows 10 and 11 and is a free download for Mac. After someone signs in with their work account, a OneDrive folder appears in File Explorer or Finder, and anything saved there is uploaded automatically. The same app also syncs SharePoint libraries and Teams channel files.

Microsoft publishes a recommended sync app configuration for administrators. The points that matter for a small office:

• Sign people in automatically. On computers joined to your Microsoft 365 organization, a policy called silent account configuration signs the user in to OneDrive without any prompts.
• Turn on Known Folder Move.
• Keep Files On-Demand enabled.
• Let the app update itself. It does so in the background.
• Block personal OneDrive accounts on work computers if you want to keep company files out of personal storage.

These policies can be applied with Microsoft Intune, which is included in Business Premium, or with Group Policy where a Windows domain exists. Our Intune guide explains that side. Without either, the same settings can be switched on by hand on each computer.

What Is Known Folder Move?

Known Folder Move (the app calls it “folder backup”) redirects the standard Windows folders into OneDrive. Microsoft’s documentation lists Desktop, Documents, Pictures, Screenshots, and Camera Roll. On a Mac, the app offers the same for Desktop and Documents.

Why it matters: most people save to the Desktop or Documents out of habit. With Known Folder Move on, those habits stop being a risk. If the laptop fails or is stolen, the person signs in on a replacement and their files are there.

To turn it on for one computer:

1. Click the OneDrive cloud icon near the clock, then the gear icon, then Settings.
2. Open the Sync and back up tab and select Manage backup.
3. Switch on Desktop, Documents, and Pictures, then save.

To turn it on for everyone, Microsoft provides two policies: one that prompts users to move their folders, and one that moves them silently. A third policy prevents people from turning it off.

Things to check first:

• Size. Someone with 300 GB of video on their Desktop will upload all of it. Look before enabling.
• Old Outlook data files and application databases in Documents do not sync well. Move them elsewhere first.
• Existing folder redirection. Microsoft warns that Known Folder Move does not work if the older Windows Folder Redirection Group Policy is already redirecting those folders. That has to be unwound first.
• Shared computers. Each person’s files follow their own sign-in, so a shared front desk PC needs separate Windows accounts.

What Is Files On-Demand?

Files On-Demand lets a computer show every file in OneDrive and synced libraries without downloading them all. Microsoft’s support article notes it has been on by default since OneDrive build 23.066.

Each file shows one of three states:

Icon	Meaning	Uses disk space	Works offline
Blue cloud	Online-only. Downloads when opened.	No	No
Green check in a white circle	Opened recently, stored locally. Windows can free it up later.	Yes	Yes
White check in a solid green circle	”Always keep on this device.”	Yes	Yes

Right-click any file or folder to choose Always keep on this device or Free up space.

Practical advice: anyone who works on a plane, at a job site, or anywhere with poor signal should mark their active project folders as always kept. Otherwise they will find a list of files they cannot open.

How Should You Set Sharing Controls?

Sharing from OneDrive uses the same link types and the same admin settings as SharePoint. The organization-wide setting is in the SharePoint admin center under Policies, then Sharing, and OneDrive has its own slider there. Per Microsoft’s sharing settings article, the OneDrive level can match the SharePoint level or be more restrictive, never more permissive.

The four levels, from most open to most closed:

1. Anyone: links work without sign-in.
2. New and existing guests: recipients must sign in or enter a verification code.
3. Existing guests: only outside people already in your directory.
4. Only people in your organization: no external sharing.

A sensible baseline:

• Set OneDrive to New and existing guests, or tighter if staff never share outside.
• Make the default link type Specific people.
• If Anyone links stay on, set them to expire and to view-only.
• Set guest access to expire after a set number of days.
• Show staff how to review what they have shared: in OneDrive on the web, open the Shared view and filter to items they have shared.

If sharing a folder with a customer has become routine, that folder probably belongs in a SharePoint site with guest access, where it is visible to the business and not dependent on one employee’s account.

How Do You Restore Files?

OneDrive has three layers of self-service recovery.

Version History

Right-click a file, choose Version history, and open or restore an earlier version. This is the fix for “I saved over the good copy.” Administrators control how many versions are kept. Microsoft describes both a count-based limit (500 is a common setting) and a newer automatic setting that trims older versions to save storage.

Recycle Bin

Deleted files go to the OneDrive recycle bin. For work accounts, Microsoft’s restore article says files can be restored for 93 days unless an administrator has changed the setting. If the user empties their recycle bin, the items move to a second-stage bin that an administrator can reach, for the remainder of those same 93 days. After that they are gone.

Restore Your OneDrive

For larger incidents, such as ransomware encrypting synced files or a mass deletion, the Restore your OneDrive feature rolls the entire OneDrive back to a chosen point within the last 30 days. It is reached from the settings gear in OneDrive on the web. An activity chart helps you pick the moment before things went wrong.

Why Is OneDrive Not a Backup?

Sync and backup solve different problems. Sync makes every copy match. Backup keeps an independent copy that does not change when the original does.

The specific limits:

• Retention is short. 93 days in the recycle bin, 30 days for a full restore. A file deleted in January and needed at tax time is gone.
• Mistakes sync. Deletions, overwrites, and ransomware encryption are faithfully copied to the cloud. Version history and restore usually help, within the windows above.
• Departed employees. When a user is deleted, Microsoft’s retention documentation says their OneDrive is kept for 30 days by default (an administrator can extend this), with the manager given access, and then deleted. Separately, a OneDrive without a valid license becomes read-only after 60 days and is archived after 93, after which getting the content back requires an administrator to assign a license or enable billing for archived storage.
• Same account, same risk. If an attacker or a disgruntled administrator has control of the account, they can also empty the recycle bins.
• It is one copy with one vendor. The long-standing 3-2-1 guideline calls for copies in more than one place.

An independent Microsoft 365 backup service copies OneDrive, SharePoint, Teams, and mailboxes to separate storage with its own retention. We explain what to look for in does Microsoft 365 need a backup, and the wider picture in our business data backup guide.

When Do You Not Need to Do Much?

If everyone already works from SharePoint libraries and nobody saves to their Desktop, OneDrive needs little attention beyond sharing settings. And a computer that only runs one line-of-business application, such as a front desk check-in station, has nothing in its user folders worth syncing.

Common Mistakes

• Running the business out of one person’s OneDrive, often the owner’s. Move shared folders to SharePoint.
• Leaving Known Folder Move off, so the Desktop and Documents folders exist only on the laptop.
• Mixing Sync and Add shortcut to OneDrive for the same SharePoint library. Choose one.
• Syncing enormous libraries to every computer. Microsoft recommends keeping the total under 300,000 files across everything a computer syncs.
• Signing a personal OneDrive into a work computer and saving company files to it.
• Deleting a departed employee’s account before anyone has checked their OneDrive. Make it a step in your offboarding checklist.
• Assuming the recycle bin is a backup.

Common Questions

How much OneDrive storage do we get?

Microsoft’s pricing page lists 1 TB of cloud storage per user on Business Basic, Standard, and Premium. This is separate from the organization’s pooled SharePoint storage, and separate from each person’s mailbox.

Does OneDrive work on a Mac?

Yes. The sync app runs on macOS with Files On-Demand and folder backup for Desktop and Documents, and Microsoft’s deployment guidance covers both Windows and Mac. File names that are valid on a Mac but not in OneDrive, such as those with certain special characters, will need renaming.

Can an administrator see what is in someone’s OneDrive?

Not by default, but an administrator can grant themselves or a manager access when there is a business reason, such as retrieving files after someone leaves. Staff should treat work OneDrive as company storage, not private storage.

How long are deleted OneDrive files kept?

For work accounts, 93 days from the moment of deletion, across the user’s recycle bin and the administrator’s second-stage bin combined, unless an administrator has changed the setting. After that the files cannot be recovered from Microsoft 365, which is the main reason to keep an independent backup.

Does OneDrive protect against ransomware?

Partly. If ransomware encrypts synced files, version history and Restore your OneDrive can roll them back, as long as you notice within 30 days. It does not stop the attack, and it does not cover files outside OneDrive. See our guide to protecting a small business from ransomware.

How Coastal Growth Co. Can Help

We can turn on Known Folder Move and Files On-Demand across your computers, set sharing policies, move company files out of personal OneDrive accounts into SharePoint, and put an independent backup in place. This is part of our Microsoft 365 and cloud services. To review your current setup, contact us. Scope and price are agreed before any paid work.