OneDrive

OneDrive is Microsoft’s file storage service. It comes with every Microsoft account, is built into Windows, and is sold with Word, Excel and the other Office apps in Microsoft 365 plans. It is reviewed here on the same five criteria as every other service in this section, as a point of reference rather than a recommendation. Our explainer on mainstream cloud storage and privacy explains what this kind of trade-off means for a personal account.

The review turns on one fact: Microsoft holds the keys. Files are encrypted on the way to Microsoft and on its disks, but Microsoft’s systems decrypt them to index them for search, scan them against its rules, and hand them over when a warrant requires it. A personal account has no setting that changes this, and Personal Vault, despite its name, does not either.

What OneDrive offers in return is integration: it is already on every Windows PC, Office documents can be edited by several people at once, 1 TB comes with Microsoft 365 Personal for $99.99 a year, and a forgotten password does not cost you your files.

Encryption & Key Custody

Microsoft says each file in OneDrive is encrypted at rest with its own AES-256 key, and that these keys are in turn encrypted with master keys stored in Azure Key Vault, Microsoft’s own key service. That is encryption at rest: it protects your files if a disk leaves a Microsoft data center. It does not keep them from Microsoft, because Microsoft controls the master keys. That is key custody with the provider. Microsoft says its engineers have no standing access to the service and must request time-limited access, with the role that reaches customer data checked most closely; that is a rule Microsoft sets for its own staff, not a technical barrier against Microsoft.

Microsoft’s privacy statement says it indexes the contents of your OneDrive documents so you can search them. There is no metadata encryption that keeps file names, folder structure or contents from Microsoft’s systems.

Personal Vault is a folder inside OneDrive that asks for a second identity check, such as a code from the Microsoft Authenticator app, a fingerprint or a PIN, every time you open it, and locks itself after 20 minutes of inactivity on the web or 3 minutes on a phone. On Windows 10 PCs its files sync to a BitLocker-encrypted area of the disk. Microsoft does not describe separate encryption keys for the vault, so it protects against someone who gets into your account or your device, not against Microsoft. Microsoft also says that on Windows 10 the vault does not hide file names while it is locked. Files in the vault cannot be shared, and a free account can keep only three files there.

Sharing goes through Microsoft’s servers. A link sent to someone opens a file that Microsoft can read like any other; Microsoft 365 subscribers can add a password or an expiry date to the link, which limits who opens it, not what Microsoft sees.

Microsoft does sell a mode in which it cannot open files, called Double Key Encryption, but only to organizations on Microsoft 365 E5. The organization keeps one of the two keys, and OneDrive can store such files but cannot open them on the web, search them or let several people edit them. A personal or family plan has nothing comparable.

The one advantage of this model is account recovery. If you forget your password, Microsoft sends a verification code to your recovery email or phone, you set a new password, and your files are still there.

Trust & Transparency

The OneDrive apps and servers are closed source, and Microsoft publishes no security audit of OneDrive’s encryption. Microsoft 365 holds an ISO/IEC 27001 certificate confirmed by an accredited auditor, with OneDrive among the services in scope, but the certificate covers Microsoft’s security management for its business services, and the audit reports are requested through Microsoft’s Service Trust Portal rather than published. It says nothing about who can read a personal account’s files.

Microsoft’s privacy statement says it uses “scanning technologies (like hash matching)” to prevent harm and child exploitation, and may share information with the National Center for Missing and Exploited Children and with law enforcement. The Services Agreement adds that automated systems and people may review content for spam, malware, fraud and other illegal or harmful material, and that a violation can lead Microsoft to close the Microsoft account at once, with the files in it. The same agreement says Microsoft does not use your documents, photos or other personal files to target advertising to you.

Whether your files can end up in AI training depends on which Microsoft service reads them. The privacy statement says Microsoft “may use your data to develop, train, and fine-tune our AI models”. For Copilot inside Word, Excel, PowerPoint, Outlook and OneNote on a Microsoft 365 home plan, Microsoft says prompts, responses and file contents are not used to train foundation models, and Copilot reads only the file you are working in or one you point it to. A file you upload to the separate Copilot app falls under that app’s rules: Microsoft’s Copilot privacy page says such files may be used for training unless you opt out. OneDrive Photos is also rolling out face grouping, which collects “facial scans and biometric information” from your photos to group them by person. Some regions ask for your consent first; elsewhere the People section appears on its own once the feature reaches your account. Microsoft says the face data is not used to train its models and is deleted within 30 days of turning the feature off.

Microsoft’s Services Agreement names Microsoft Corporation of Redmond, Washington, as the contracting party; for people in the European Economic Area, the UK and Switzerland, Microsoft Ireland Operations Limited is the data controller together with Microsoft Corporation. Microsoft says data is usually stored in your region or in the United States. Its transparency report covers all Microsoft services together. In the second half of 2025 it received 5,587 demands for consumer data from US law enforcement, 115 of them warrants for content stored outside the United States, which US law lets authorities compel regardless of where the data sits. Requests under the Foreign Intelligence Surveillance Act (FISA) for content are reported only in ranges: in the first half of 2025 they affected between 33,500 and 33,999 accounts. Microsoft says content requires a warrant, that it notifies users unless the law forbids it, and that it gives no government its encryption keys; since Microsoft holds the keys to your files, a valid order can still reach them.

Beyond the files themselves, Microsoft holds your name, phone number and recovery email, payment details, and the IP addresses and devices you connect from. The privacy statement says its products always collect required diagnostic data and only the optional part can be turned off, so the telemetry is always on.

Security incidents

OneDrive’s sign-in is the Microsoft account, and that system has a confirmed data breach. From May 15, 2023, a China-based group that Microsoft calls Storm-0558 used a stolen Microsoft account signing key to forge sign-in tokens and read email at about 25 organizations, government agencies among them, and in related personal accounts, through Outlook on the web and Outlook.com. A validation error in Microsoft’s code let the consumer key work for business accounts too. Microsoft revoked every signing key that was valid at the time and moved the new ones to the key store it uses for business systems. Microsoft says no other environment was affected, and it does not report any access to OneDrive files.

Features & Sync

The desktop sync app runs on Windows 10 and 11 and on macOS 15.8 or later; there is no Linux app. Mobile apps run on Android 8.0 and iOS 18.0 or later, and the website works in current browsers. A single file can be up to 250 GB.

File versioning covers every file type but lasts 30 days: earlier versions are kept for 30 days, and deleted files stay in the recycle bin for 30 days on a personal account. Microsoft 365 subscribers also get ransomware detection and can roll the whole OneDrive back to any point in the last 30 days.

Collaborative editing of Word, Excel and PowerPoint files works in the browser and in the apps, with several people in one document at once. The editing runs on Microsoft’s servers, so Microsoft can read these documents.

Usability & Platforms

OneDrive is part of Windows and signs in with the Microsoft account you already use there; on macOS, Android, iPhone and iPad you install the app. The account supports two-factor authentication with codes by email, text message or the Authenticator app, and passkeys. A forgotten password is reset with a code, as described above. Password-protected and expiring links require a paid plan.

The Services Agreement asks you to sign in to OneDrive at least once a year; otherwise Microsoft closes your OneDrive. If you stay over your storage quota and ignore Microsoft’s notices, it may delete the content or disable access to it.

Price & Value

The free tier gives 5 GB of file storage. Microsoft 365 Basic gives 100 GB for $19.99 a year or $1.99 a month. Microsoft 365 Personal gives one person 1 TB for $99.99 a year or $9.99 a month, together with the Word, Excel, PowerPoint, Outlook and OneNote desktop apps. Microsoft 365 Family costs $129.99 a year or $12.99 a month for up to six people, who share 2 TB; each person sees only their own files unless they share them. Family plans bought before October 8, 2026 move to the shared 2 TB at the first renewal on or after May 2, 2027. Microsoft says these are the regular prices you keep paying.

Microsoft refunds a new subscription cancelled within 30 days of purchase, and also the latest renewal charge if you cancel within 30 days of it, once per account and plan. Plans bought through Google Play or the App Store follow those stores’ rules.

Pros and Cons

Our Rating