Microsoft OneDrive

Is OneDrive safe?

Mostly, yes. OneDrive encrypts every file on Microsoft's servers with its own key, scans downloads for malware, and gives Microsoft 365 subscribers a 30-day rollback if ransomware scrambles their files. Microsoft says it does not use your documents or photos to target ads. What holds it back is control: Microsoft holds the keys, nothing in OneDrive is end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, and Windows 11 can quietly start uploading your Desktop and Documents folders the first time you sign in. We score OneDrive 66/100, below Google Drive (70) and well below iCloud (75).

Does Windows back up your files to OneDrive without asking?

It can. When you set up a Windows 11 PC with a Microsoft account, Thurrott's Windows 11 field guide notes that you "may be told" that Desktop, Documents and Pictures are being backed up to OneDrive automatically, or be offered a choice, and that "it's a little different every time".

That matters for privacy and for money. Files you thought lived only on your laptop end up in Microsoft's cloud, and a full Desktop can fill the free 5 GB quickly. Undoing it is awkward: Microsoft's help page says that when you stop backing up a folder, the files already backed up "stay in the OneDrive folder, and will no longer appear in your device folder". You have to move them back yourself.

Can Microsoft see your OneDrive files?

Its systems process them. Microsoft's privacy statement says it indexes OneDrive content so you can search it, scans for malware, and uses hash matching to detect child exploitation material, which it may report to the US National Center for Missing and Exploited Children. Microsoft says engineers have no standing access to the service and must request time-limited access for a specific incident.

Encryption is real but not end-to-end. Each file gets a unique AES-256 key, and those keys are wrapped by master keys Microsoft keeps in Azure Key Vault. Personal Vault, the locked folder for passports and insurance papers, adds a second sign-in step and locks after 20 minutes of inactivity. On Windows it syncs to a BitLocker-encrypted area of the disk. Microsoft does not call it end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, and its own description gives no reason to think Microsoft lacks the keys.

Apple's App Store label for OneDrive has no "Used to Track You" section, which is good. It does list photos, audio, other user content, user ID and device ID as linked to you for analytics, which is more than Google declares for Drive.

Face grouping you can only switch off three times a year

In 2025 Microsoft began a preview of People, which groups photos of the same person across your OneDrive library. Microsoft's help page says it runs in the cloud, only on personal accounts, and that some regions need your consent first. The Register reported in October 2025 that Microsoft's documentation limits changes to the setting to three times a year, without saying how the year is counted. Microsoft says it will not use face data to train its AI models and that grouping data is deleted within 30 days of switching the feature off. Face data counts as biometric data under GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary and some US state laws, and we found no regulator decision on this feature yet.

Security track record

We found no breach of OneDrive storage itself. Microsoft as a company has a weaker record than its cloud marketing suggests: in April 2024 the US Cyber Safety Review Board blamed "a cascade of security failures at Microsoft" for a 2023 intrusion in which Chinese hackers used a stolen Microsoft signing key to read email accounts. OneDrive shares the same Microsoft account sign-in. Microsoft pays $300 to $20,000 for OneDrive bugs through its online services bounty.

How to use OneDrive safely

1. Check OneDrive's backup settings on every new Windows PC and switch off folders you do not want in the cloud.
2. Protect your Microsoft account with a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or the Authenticator app, not SMS alone.
3. Keep identity documents in Personal Vault, and encrypt the most sensitive files yourself before uploading.
4. Use links for named people, or set a password and expiry date on paid plans, instead of "anyone with the link".
5. Treat unexpected "shared a file with you" emails as suspect and open OneDrive directly instead of clicking.
6. Turn off People in OneDrive Photos settings if you do not want face grouping, and do it once.

How we scored it

The regulatory record (88) is OneDrive's best factor: we found no fine or order about OneDrive itself, and fines on other Microsoft services do not count here. Security (68) comes next, with per-file encryption, malware scanning and ransomware recovery, held back by the lack of end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary and Microsoft's wider security record. Privacy (58) and transparency and control (60) are the weakest, because of the user content listed for analytics, default folder backup and the limit on the face grouping setting.