Why the cloud usually survives ransomware
When ransomware encrypts a synced file, the OneDrive client uploads the encrypted version as a new version — it doesn't overwrite the history. So the clean prior versions remain (versioning-recycle concept). This is the core of cloud resilience: encryption creates versions rather than destroying them, and you roll back.
The recovery tools, in order
- Version history — restore an individual file to its last clean version. Fine for a handful of files.
- Files Restore / "Restore this library" — the mass-recovery tool. Roll an entire OneDrive or document library back to a point in time within the last 30 days, using the version + activity history. This is what you reach for after a bulk-encryption event: pick a timestamp just before the attack and rewind everything at once, self-service.
- Recycle bin — recover deleted (not encrypted) items within the 93-day window.
- Retention / Preservation Hold Library — content under a hold has preserved copies beyond the above windows (retention concept), an incidental backstop.
The realistic RPO/RTO
- Recovery point: as good as your version history and within the 30-day rewind horizon — an attack discovered on day 40 is past self-service rewind.
- Recovery time: Files Restore is fast for a OneDrive/library but is per-container — restoring thousands of sites one by one is slow, which is the gap Microsoft 365 Backup addresses.
Microsoft 365 Backup (the extension)
Microsoft 365 Backup (GA) provides native, faster, point-in-time restore across many SharePoint sites, OneDrive accounts and Exchange mailboxes at once, with a longer retention than the built-in windows — the answer to "we need estate-wide, longer-than-30-day recovery without stitching third-party backups." It's a paid add-on, but it directly closes the per-container and 30-day limitations.
The failure modes
- Version-limit exhaustion. If a library's version limit is low and ransomware edits each file many times, clean versions can be pushed out — set sane version limits (versioning concept) so history survives an attack.
- 30-day blind spot — slow-burn or late-discovered attacks fall outside self-service rewind; only holds or Microsoft 365 Backup reach further.
- "Sync is backup" fallacy — KFM/sync propagate the encryption; they are not the recovery mechanism, versioning is (Known Folder Move concept).
- Files Restore is per-user/per-library — no single "restore the whole tenant" button without Microsoft 365 Backup.
- Recycle bin won't help against encryption — the files weren't deleted, they were versioned; you need version-based restore, not the bin.
What to watch (proofs)
- Version depth: library/OneDrive versioning settings — enough versions retained to survive multi-write encryption.
- Restore availability: the "Restore this library" / OneDrive Files Restore option present and the 30-day slider populated — the rewind envelope confirmed.
- Backup coverage: whether Microsoft 365 Backup is enabled and which sites/OneDrives are protected — the beyond-30-day, estate-wide position.
- Drill evidence: a documented test restore (a library rewound to a prior point) — proof the recovery path actually works before you need it.