OneDrive occupies a strange position in most businesses: officially it’s “personal work storage,” unofficially it’s where an enormous share of the company’s active work actually lives — every user’s Desktop and Documents (if Known Folder Move is on), the drafts, the exports, the spreadsheet that turned out to matter. That quiet importance is exactly why it deserves deliberate protection, and why its specific risks — which differ from SharePoint’s — are worth knowing by name. Here they are, with the fixes.
Risk one: sync carries damage both directions
OneDrive’s superpower is synchronization, and sync replicates bad changes as faithfully as good ones: the local deletion propagates up, the ransomware-encrypted files sync over their healthy cloud copies, the botched bulk rename lands everywhere at once. OneDrive’s native nets — the recycle bin (93 days) and the rolling 30-day full restore (“Restore your OneDrive,” genuinely useful and worth knowing exists) — handle the caught-quickly cases well. What they don’t handle: problems discovered late, restores across many users at once, and anything an attacker with account access can reach — the nets live inside the account. The structural fix is the same as the whole M365 estate’s: independent third-party backup covering OneDrive, with real retention, restorable per-user or in bulk.
Risk two: the departure countdown
Here’s the OneDrive-specific trap that catches businesses over and over: when a departed employee’s account is deleted or their license removed, their OneDrive enters a countdown — typically 30 days — and then it’s gone. The salesperson’s quote archive, the bookkeeper’s working files, the project folders that were “personal” only in the technical sense: discovered missing in month three, unrecoverable. The fix is procedural and belongs on the offboarding checklist by name: preserve before you deprovision — transfer OneDrive contents to the manager or an archive location (the admin center supports this directly), or ensure the backup tool retains departed users’ data without a license, then release the account. Order of operations is the entire control.
Risk three: sharing sprawl, one link at a time
Every “Copy link” click is an access decision, and across a company-years of them, OneDrive accumulates a sediment of shares nobody remembers: the “anyone with the link” URL to a pricing sheet, forwarded who-knows-where; the external collaborator from a 2023 project whose access never expired; the file shared “temporarily” that’s been reachable ever since. The fixes are policy-level, not vigilance-level: tenant sharing defaults set deliberately — internal-only default links, expiration on anyone-links, external sharing restricted where the data classification says so — plus periodic access reviews on the accounts that handle sensitive material. One person’s good judgment doesn’t scale; defaults do.
Risk four: the account is the perimeter
Everything in OneDrive sits behind one login — so OneDrive protection is, bluntly, account protection: MFA enforced, legacy authentication blocked, sign-in policies applied, and app-consent grants audited, since a malicious app with Files.Read.All permission reads every OneDrive it’s granted into. Add device sanity for the sync clients: OneDrive happily syncs the company’s files onto whatever machine signs in, so “which devices can sync?” is a policy question with a policy answer — and encryption on those endpoints closes the stolen-laptop chapter.
The quiet upside: OneDrive as the endpoint strategy
Handled well, OneDrive isn’t just a risk to manage — it’s the solution to a harder problem: with Known Folder Move enforced, every desktop’s working files flow automatically into a protected, backed-up, manageable system, and a lost or dead laptop becomes a sign-in on new hardware. The same feature that concentrates the risk concentrates the protection — which is the argument for doing this deliberately rather than letting it happen by default.
The bottom line
OneDrive is where individual work actually lives, so protect it like it matters: independent backup behind the native nets, preserve-then-deprovision stapled to offboarding, sharing governed by defaults instead of hope, and the accounts and devices around it hardened. Four settings-and-procedures, one afternoon with whoever runs your tenant — and the most-used folder in the company stops being the least-considered one.