OneDrive Security Best Practices: Complete 2026 Guide

Quick Answer: The most important OneDrive security best practices are: enforce MFA, restrict external sharing at the admin level, use sensitivity labels on confidential files, set expiry dates on sharing links, enable Known Folder Move to back up desktops automatically, and understand the difference between OneDrive version history and a real backup. This guide explains each one simply.

Key Takeaways

• Microsoft secures the OneDrive infrastructure — encryption, data centres, and server-level protections are Microsoft’s responsibility. How you share and who can access your files is your responsibility.
• <cite index=”3-1″>OneDrive encrypts every file at rest with a unique AES-256 key</cite> and protects data in transit with TLS — but this does not protect you from a misconfigured sharing link.
• The #1 OneDrive security mistake is leaving external sharing set to “Anyone with the link” — meaning any file link, accidentally forwarded, becomes publicly accessible.
• Sensitivity labels (included in Microsoft 365 Business Premium) automatically encrypt confidential files and travel with them even when shared externally.
• OneDrive version history is not a backup — it covers accidental changes but has limits. A separate M365 backup solution is required for proper recovery.
• Every setting in this guide is configurable in the Microsoft 365 Admin Centre or SharePoint Admin Centre — no extra tools required for most organisations.

What Microsoft Protects vs. What You Must Configure

This is the most important thing to understand about OneDrive security.

Microsoft takes care of the infrastructure layer — the servers, the encryption, the data centres. <cite index=”3-1″>Each file is encrypted at rest with a unique AES-256 key, and data in transit is protected with Transport Layer Security (TLS).</cite> Microsoft engineers operate under a zero-standing access policy — they cannot access your data without a specific, time-limited, logged request.

That is all Microsoft’s job. You do not configure any of it.

Your job is everything above that layer:

• Who you share files with
• What permissions sharing links grant
• Whether confidential documents are labelled and protected
• Whether sensitive data can leave your organisation via OneDrive
• Whether you have a proper backup (not just version history)

Most OneDrive breaches do not happen because Microsoft’s servers were hacked. They happen because someone shared a file with the wrong permissions, left a link active too long, or because a compromised account accessed files that had no additional protection.

The rest of this guide focuses entirely on what you control.

Best Practice 1: Enforce MFA for Every OneDrive User

OneDrive is only as secure as the account that accesses it.

If a staff member’s Microsoft 365 password is stolen through phishing, the attacker has instant access to every file in their OneDrive — 1TB of business files, potentially including client contracts, financial records, and personal information.

Multi-factor authentication stops this. Even with the correct password, an attacker without the second factor (the phone app or hardware key) cannot get in.

How to enforce it:

In the Microsoft Entra Admin Centre → Security → Conditional Access → Create a policy requiring MFA for all users accessing all cloud apps.

This is not optional for Australian businesses. MFA is a direct requirement under ACSC Essential Eight Maturity Level 1 — the baseline every organisation should meet.

Microsoft’s own data shows MFA blocks 99.9% of automated account takeover attacks.

See our conditional access policy examples for the exact policies to configure.

Best Practice 2: Fix Your External Sharing Settings (Admin Level)

This is the most commonly misconfigured OneDrive setting — and the one that causes the most data exposure.

The four external sharing levels in Microsoft 365:

The “Anyone” setting is the problem. When set to Anyone, a sharing link can be forwarded to any person on the planet and they can access the file — no login, no verification, no record of who viewed it.

How to change it:

Go to the SharePoint Admin Centre (admin.microsoft.com → SharePoint → Policies → Sharing) → Set “OneDrive” external sharing to New and existing guests or Only people in your organisation, depending on your business needs.

For most Australian businesses: “New and existing guests” is the right balance — external sharing works, but recipients must verify their identity.

Additional sharing controls to configure:

• Require recipients to sign in with the same account the sharing invitation was sent to
• Set a default expiry on “Anyone” links — if you must allow them, set a 7 or 14 day maximum expiry so links do not stay active indefinitely
• Allow sharing only with specific domains (your known client domains)

Best Practice 3: Set Expiry Dates and Passwords on Sharing Links

Even when external sharing is enabled appropriately, individual sharing links need controls.

Two settings that significantly reduce risk:

Expiry dates: A sharing link that never expires stays active long after the business reason for sharing is gone. An invoice shared with a client in January 2024 does not need to still be accessible in July 2026.

In SharePoint Admin Centre → Sharing → Set “Choose expiration and permissions options for Anyone links” → set a maximum link expiry (14 or 30 days is a good default).

Password protection: Require a password to open a shared link. The recipient needs both the link and the password — so even if the link is forwarded, the file cannot be opened without the password.

In Microsoft 365 Business Premium and above, you can require a password on sharing links by default. Configure this in SharePoint Admin Centre → Sharing → “Require password for Anyone links.”

This directly addresses a common Privacy Act compliance gap — sharing a file containing client personal information via a password-free, non-expiring link is not a “reasonable step” to protect that data.

Best Practice 4: Use Sensitivity Labels on Confidential Files

Here is the difference between encryption that travels and encryption that does not.

When a file is encrypted at rest in OneDrive (which Microsoft does automatically), that encryption only protects it while it sits in Microsoft’s data centres. The moment the file is downloaded or shared, the encryption is handled by the recipient’s device and network — not necessarily yours.

Sensitivity labels solve this. A label like “Confidential” or “Client Data” applies encryption that travels with the file — so even when it is downloaded, emailed, or shared externally, only authorised people can open it.

How to set them up:

In the Microsoft Purview compliance portal (compliance.microsoft.com) → Information protection → Labels → Create a label

Example label structure for Australian businesses:

• Public — no protection, anyone can open
• Internal — accessible to all staff, no external access
• Confidential — encrypted, requires sign-in with a verified Microsoft account to open
• Highly Confidential — encrypted, access restricted to named individuals only

Enable auto-labelling to classify files automatically — a file containing Tax File Numbers, credit card numbers, or Medicare numbers is automatically labelled and protected without the user needing to do anything.

Which plan: Sensitivity labels are included in Microsoft 365 Business Premium. Auto-labelling requires Purview Information Protection P2 (included in E5 or as an add-on).

For the full Purview configuration, see our Microsoft 365 security guide.

Best Practice 5: Enable Known Folder Move (KFM)

This is one of the highest-impact OneDrive settings that most businesses have never heard of.

The problem it solves: Most employees save files to their desktop, Documents folder, and Pictures folder by default. These folders sit on the local device — and are completely lost if the device is stolen, fails, or is wiped remotely.

Known Folder Move (KFM) automatically redirects Desktop, Documents, and Pictures to OneDrive. The files appear exactly where the user expects them — on the desktop, in the Documents folder — but they are syncing to OneDrive in the background, continuously.

What this means:

• If a laptop is stolen, the employee’s files are safe in OneDrive
• If a device fails, the new device is set up and KFM re-syncs everything automatically
• Remote wipe of a lost device does not cause data loss

How to enable it:

Via Microsoft Intune → Devices → Configuration profiles → Templates → Administrative Templates → OneDrive → “Silently move Windows known folders to OneDrive” → Enabled

Or via Group Policy if your organisation uses on-premise Active Directory.

This should be on for every managed device. It is the OneDrive equivalent of automatic backup — and it is included at no extra cost.

Best Practice 6: Configure DLP Policies for OneDrive

Data Loss Prevention (DLP) policies stop sensitive information from leaving your organisation via OneDrive shares without anyone realising.

Without DLP, a staff member can upload a spreadsheet of client Tax File Numbers to their OneDrive and share it publicly via an “Anyone” link. The file leaves the organisation with no alert, no record, and no protection.

With DLP, that action is blocked and the user is shown a policy tip explaining why.

How to set up DLP for OneDrive:

In Microsoft Purview compliance portal → Data loss prevention → Policies → Create policy

• Choose template: Australia Privacy Act / Australian Personally Identifiable Information
• Locations: Include OneDrive accounts
• Actions: Block external sharing when sensitive content is detected, notify the user, notify IT admin
• Policy tips: Show a message to the user explaining why the sharing was blocked

What this does in plain English: If a file shared via OneDrive contains Medicare numbers, Tax File Numbers, passport numbers, or credit card numbers, OneDrive blocks the external share and alerts IT. The user sees a message explaining the policy.

This is one of the clearest “reasonable steps” you can demonstrate under the Australian Privacy Act 1988 — automated controls that prevent personal information from being shared without authorisation.

Which plan: DLP is included in Microsoft 365 Business Premium.

Best Practice 7: Understand What OneDrive Version History Is (and Is Not)

This is where many businesses have a dangerous misconception — and discover it too late.

What version history does:

<cite index=”3-1″>OneDrive keeps version history for all file types, allowing you to restore a previous version of a file or recover a deleted file from the recycle bin.</cite> If you accidentally delete a file, you have 93 days to recover it from the recycle bin. If a file is corrupted or changed, you can roll back to a previous version.

What version history does NOT do:

• It does not protect against a Microsoft service outage or data centre failure (rare but possible)
• It does not provide a complete point-in-time snapshot of your entire OneDrive
• It does not protect against a compromised admin account deleting data at the admin level
• It does not give you an independent copy of your data outside of Microsoft’s infrastructure
• Retention limits mean very old versions may be purged

What you actually need: A dedicated Microsoft 365 backup solution — either Microsoft 365 Backup (Microsoft’s own paid add-on, available from late 2023) or a third-party tool like Datto or Veeam — creates a separate, independent copy of your OneDrive data that can be restored even in scenarios where version history is unavailable.

<cite index=”3-1″>Microsoft 365 offers ransomware detection and the ability to restore files up to 30 days after a malicious attack.</cite> But a proper backup extends this protection significantly further and provides independence from Microsoft’s infrastructure.

Our M365 backup solutions guide and OneDrive backup guide cover what an independent backup looks like in practice.

Best Practice 8: Review and Restrict Synced Devices

The OneDrive sync client on a device means that device has direct, continuous access to your OneDrive files.

If an employee’s personal laptop is syncing OneDrive but has no antivirus, no encryption, and no management — ransomware on that device can encrypt your entire OneDrive.

Controls to put in place:

In the SharePoint Admin Centre → Settings → OneDrive → Sync:

• Allow syncing only on devices joined to specific domains — prevents personal devices from syncing unless enrolled in Intune
• Block sync on devices that are not managed by an organisation — requires Intune device compliance

Connect this to Conditional Access: require a compliant, managed device before any OneDrive sync client is permitted. This is configured in Microsoft Entra ID → Conditional Access → require compliant device for all cloud apps.

Why this matters: OneDrive ransomware protection is good — <cite index=”3-1″>OneDrive detects ransomware attacks and alerts you, allowing recovery to a point in time up to 30 days before the attack.</cite> But prevention is better than recovery. Blocking unmanaged device sync eliminates a common ransomware entry path.

Best Practice 9: Enable OneDrive Personal Vault for Sensitive Files

<cite index=”3-1″>OneDrive Personal Vault is a protected area in OneDrive that requires a strong authentication method or a second step of identity verification — such as fingerprint, face, PIN, or a code sent by email or SMS.</cite>

For files that need an extra layer of protection beyond standard OneDrive — identity documents, financial records, confidential agreements — Personal Vault requires additional verification every time it is accessed, even on a device where OneDrive is already signed in.

It is not a replacement for sensitivity labels or DLP. But for individual high-sensitivity documents, it is a simple additional control that takes two minutes to set up.

Enable it: Open OneDrive (web or desktop) → Personal Vault → Set up → Choose your verification method.

Available on all Microsoft 365 personal and business plans.

OneDrive Security Checklist: Quick Reference

Account Security

• ☐ MFA enforced via Conditional Access for all users
• ☐ Password reset (SSPR) enabled so users can self-recover securely
• ☐ Admin accounts separated from standard user accounts

External Sharing

• ☐ External sharing set to “New and existing guests” (not “Anyone”) at admin level
• ☐ Default link expiry configured (14–30 days maximum)
• ☐ Password requirement on sharing links enabled
• ☐ External sharing restricted to specific trusted domains where applicable

Data Protection

• ☐ Sensitivity labels created and deployed (Public / Internal / Confidential / Highly Confidential)
• ☐ Auto-labelling enabled for Australian PII (TFN, Medicare, credit card numbers)
• ☐ DLP policy applied to OneDrive locations blocking external sharing of sensitive content
• ☐ Personal Vault set up for highest-sensitivity documents

Device and Sync Security

• ☐ Known Folder Move (KFM) enabled via Intune — Desktop, Documents, Pictures redirected to OneDrive
• ☐ Sync restricted to managed, Intune-enrolled devices only
• ☐ Conditional Access requiring compliant device for OneDrive access

Backup and Recovery

• ☐ Version history retention period reviewed (confirm files are retained for appropriate period)
• ☐ Separate M365 backup solution in place (Microsoft 365 Backup or third-party)
• ☐ Backup restoration tested — can you actually recover a deleted file from backup?

Monitoring

• ☐ Audit logging confirmed active in Microsoft Purview
• ☐ Alert policy set for unusual file deletion (mass delete events)
• ☐ Alert policy for external sharing of sensitive files
• ☐ Monthly review of active external sharing links

OneDrive Security and Australian Compliance

For the full Essential Eight compliance mapping, see our Essential Eight checklist.

Related Reading

• OneDrive — Using OneDrive effectively in your business
• OneDrive Backup — What a proper OneDrive backup looks like beyond version history
• M365 Backup Solutions — Choosing the right backup for your Microsoft 365 environment
• Microsoft 365 Security — Securing the full M365 environment OneDrive sits within
• Conditional Access Policy Examples — The identity controls that gate OneDrive access
• Mailbox Auditing in Exchange Online — Audit logging that covers OneDrive alongside email
• SharePoint Library Guide — SharePoint security that parallels OneDrive best practices
• Endpoint Hardening Checklist — Securing the devices that sync OneDrive

Frequently Asked Questions

What are the most important OneDrive security best practices?

The most important OneDrive security best practices are: enforce MFA for all accounts via Conditional Access (stops account takeover even with a stolen password), restrict external sharing at the admin level to require sign-in from recipients, set expiry dates on all external sharing links, apply sensitivity labels to confidential files so encryption travels with the file, enable Known Folder Move to automatically back up desktops to OneDrive, and deploy DLP policies to prevent sensitive data from being shared externally without authorisation. All of these are configurable in Microsoft 365 at no additional cost for Business Premium subscribers.

Is OneDrive secure enough for confidential business files?

Yes — when properly configured. Microsoft’s infrastructure security is excellent: AES-256 encryption at rest, TLS in transit, geo-distributed data centres, and zero-standing-access for Microsoft engineers. However, infrastructure security does not protect you from misconfigured sharing links, compromised accounts without MFA, or files without sensitivity labels being shared externally. The security of your business files in OneDrive depends primarily on how you have configured sharing settings, access controls, and data protection — not on Microsoft’s servers alone.

What is the difference between OneDrive version history and a backup?

Version history allows you to restore previous versions of files or recover deleted files from the recycle bin — for up to 93 days for deleted files and unlimited versions for changed files. This protects against accidental deletion and corruption. A proper backup creates an independent copy of your data outside of OneDrive’s version history system, protects against scenarios like admin-level deletion, provides longer retention than version history allows, and stores data independently of Microsoft’s infrastructure. For Australian businesses with compliance obligations, a dedicated Microsoft 365 backup solution is required in addition to version history.

How do I stop OneDrive files from being shared publicly?

In the SharePoint Admin Centre (admin.microsoft.com → SharePoint → Policies → Sharing), set the OneDrive external sharing level to “New and existing guests” rather than “Anyone.” This requires any external recipient to sign in with a Microsoft or Google account to access shared files — preventing anonymous access via forwarded links. Additionally, set a default expiry on all sharing links (14–30 days), require passwords on sharing links, and restrict sharing to specific trusted domains if your business only works with a known set of clients and partners.

What are sensitivity labels in OneDrive and should I use them?

Sensitivity labels (configured in Microsoft Purview) are tags you apply to files and emails that define how they can be shared and whether they are encrypted. A file labelled “Confidential” can be configured to automatically encrypt when shared externally — so even if someone forwards it, only authorised people can open it. Labels can also restrict editing, forwarding, or printing. Auto-labelling can apply them automatically to files containing sensitive data like Tax File Numbers or credit card numbers. Sensitivity labels are included in Microsoft 365 Business Premium and are one of the strongest data protection controls available for OneDrive files.

What is Known Folder Move in OneDrive and why is it important?

Known Folder Move (KFM) is a OneDrive feature that automatically redirects your Desktop, Documents, and Pictures folders to sync with OneDrive in the background. Files continue to appear in the same place on your device — nothing changes for the user — but they are continuously backed up to OneDrive. If a device is lost, stolen, wiped remotely, or fails, all files are safe and can be restored to a new device instantly. KFM is configured via Microsoft Intune and is included at no additional cost. It is one of the highest-impact, lowest-friction security improvements available for any organisation running Windows devices.

Does OneDrive protect against ransomware?

Partially. OneDrive’s ransomware detection alerts you when it detects a ransomware attack pattern and allows you to restore your files to a point in time up to 30 days before the attack. This is valuable — but it is not a complete defence. Ransomware that encrypts files slowly over a period exceeding 30 days (a known attacker technique called “low and slow” ransomware) can exceed the recovery window. A managed device Conditional Access policy (blocking sync from unmanaged devices) prevents the most common ransomware delivery paths through OneDrive. A separate Microsoft 365 backup solution provides recovery options beyond the 30-day window.

This guide is maintained by the CodeHyper security team. For help configuring OneDrive security settings or a Microsoft 365 security assessment, contact our team or visit codehyper.com.au.