SECURE YOUR ONEDRIVE

Protect the files connected to your Microsoft Account.

OneDrive can contain your documents, photographs, work files, financial records and personal information. Secure the Microsoft Account behind OneDrive, protect sensitive files with Personal Vault, control sharing and prepare for lost devices and file recovery.

OneDrive security starts with your Microsoft Account.

Your Microsoft Account controls access to OneDrive. That means password security, two-step verification, trusted devices and recovery information all form part of your cloud-storage security.

What is Personal Vault?
Personal Vault is a protected area inside OneDrive that requires additional identity verification before sensitive files can be accessed.
What is two-step verification?
Two-step verification adds another authentication method after your password, making it harder for someone with only your password to access your Microsoft Account.
Why does device security matter?
OneDrive files may be synchronized or downloaded to phones and computers. Someone who gains access to an unlocked or compromised device may therefore gain access to local copies of your files.
What is OneDrive ransomware recovery?
Microsoft provides OneDrive recovery features that can help users restore files after unwanted changes or ransomware incidents. The exact recovery options depend on the account and service configuration.
Does cloud storage replace backups?
Not completely. For information you cannot afford to lose, keep an additional secure backup rather than depending entirely on one cloud account.
ONEDRIVE SECURITY

Secure the account, the files, the sharing and the devices.

Work through these checks one at a time. Start with your Microsoft Account, then protect sensitive files, sharing permissions and the devices that synchronize your OneDrive.

Secure the Microsoft Account behind OneDrive

OneDrive access is tied to your Microsoft Account, so protecting the account itself is the first layer of file security.

Click to see protection steps

Step-by-step

  1. Sign in to your Microsoft Account.
  2. Open your account's Security settings.
  3. Review your password and authentication methods.
  4. Make sure your recovery information is current.
  5. Remove security information or devices you no longer control.

VERIFY: Confirm that the Microsoft Account protecting OneDrive is secure before focusing on individual files.

Turn on two-step verification

Two-step verification adds another layer of protection when someone attempts to sign in with your password.

Click to see protection steps

Step-by-step

  1. Open your Microsoft Account.
  2. Open Security.
  3. Find the account's two-step verification settings.
  4. Follow Microsoft's current setup instructions.
  5. Choose an authentication method you can reliably access.
  6. Test the sign-in process after setup.

VERIFY: Confirm that two-step verification works before relying on it to protect your OneDrive.

Use Microsoft Authenticator where appropriate

Microsoft Authenticator can provide an additional authentication method for your Microsoft Account.

Click to see protection steps

Step-by-step

  1. Install Microsoft Authenticator through an official app store.
  2. Add your Microsoft Account to the authenticator.
  3. Follow Microsoft's verification instructions.
  4. Complete the setup.
  5. Keep an alternative recovery method available.

VERIFY: Test authentication from another sign-in before assuming your authenticator is configured correctly.

Consider passwordless sign-in

Microsoft supports passwordless authentication methods that can reduce reliance on traditional passwords.

Click to see protection steps

Step-by-step

  1. Review your Microsoft Account's available passwordless authentication options.
  2. Consider a passkey or supported authentication method on a device you control.
  3. Protect the device with a strong screen lock.
  4. Keep recovery methods available.

VERIFY: Only configure passwordless authentication on devices that you personally control and can recover.

Review your Microsoft Account security activity

Unexpected sign-ins, password changes or security changes can indicate that someone is attempting to access your account.

Click to see protection steps

Step-by-step

  1. Open your Microsoft Account's Security page.
  2. Review your recent sign-in activity.
  3. Look for unfamiliar locations, devices or sign-in attempts.
  4. Investigate anything you do not recognize.
  5. Secure the account immediately if you believe someone has gained access.

VERIFY: Do not dismiss an unfamiliar Microsoft sign-in simply because you do not immediately understand it.

Review devices connected to your account

A computer, tablet or phone signed in to your Microsoft Account may provide access to OneDrive files.

Click to see protection steps

Step-by-step

  1. Open your Microsoft Account's Devices area.
  2. Review the devices listed.
  3. Identify devices you no longer own or recognize.
  4. Remove or secure old devices where appropriate.
  5. Pay particular attention after selling, losing or giving away a device.

VERIFY: Every device with OneDrive access should be one you recognize and still control.

Protect your OneDrive files with Personal Vault

Personal Vault provides an additional layer of authentication for especially sensitive files stored in OneDrive.

Click to see protection steps

Step-by-step

  1. Open OneDrive.
  2. Locate Personal Vault.
  3. Complete the additional identity verification required by Microsoft.
  4. Store your most sensitive documents inside Personal Vault when appropriate.
  5. Allow Personal Vault to lock automatically when you finish using it.

VERIFY: Confirm that your most sensitive documents are behind the additional Personal Vault authentication layer.

Store identity documents carefully

Passports, national identity documents, certificates, financial records and similar files can be valuable to criminals.

Click to see protection steps

Step-by-step

  1. Identify sensitive documents in your OneDrive.
  2. Move especially sensitive documents to Personal Vault where appropriate.
  3. Review who has access to those documents.
  4. Remove unnecessary duplicate copies.
  5. Avoid sharing identity documents through uncontrolled links.

VERIFY: Know exactly where your most sensitive identity and financial documents are stored.

Review OneDrive sharing permissions

A private file can become exposed when it is shared with the wrong person or when a broad sharing link remains active.

Click to see protection steps

Step-by-step

  1. Open OneDrive.
  2. Select an important file or folder.
  3. Open its Share settings.
  4. Review everyone who has access.
  5. Remove people who no longer need access.
  6. Review the permission level assigned to each person.

VERIFY: Every person with access to an important file should have a current reason to access it.

Be careful with sharing links

Sharing links can make files available beyond the people you originally intended to receive them.

Click to see protection steps

Step-by-step

  1. Open the file's sharing settings.
  2. Review existing sharing links.
  3. Check whether the link has an expiration date or access restriction where available.
  4. Remove links that are no longer necessary.
  5. Avoid broad link sharing for sensitive information.

VERIFY: Confirm that every active sharing link is intentional and still necessary.

Give people the minimum access they need

Not everyone who needs to see a file needs permission to modify or delete it.

Click to see protection steps

Step-by-step

  1. Open the file's Share settings.
  2. Review each person's permission.
  3. Give view-only access when editing is unnecessary.
  4. Give edit permissions only when collaboration requires them.
  5. Remove access after a project ends.

VERIFY: Every collaborator should have only the level of access required for their task.

Review shared folders

A shared folder can expose many files at once, so its membership deserves regular review.

Click to see protection steps

Step-by-step

  1. Identify your important shared folders.
  2. Review the people and groups with access.
  3. Check whether external people still need access.
  4. Remove unnecessary collaborators.
  5. Review the folder again after major project changes.

VERIFY: Confirm that sensitive files are not sitting inside a folder with unnecessarily broad access.

Keep OneDrive synchronized devices secure

Files synchronized to a computer may be available locally even when you are not connected to the internet.

Click to see protection steps

Step-by-step

  1. Review computers where OneDrive is synchronized.
  2. Use a strong Windows or device login password.
  3. Enable Windows Hello or another supported device-protection method.
  4. Keep Windows and OneDrive updated.
  5. Do not leave synchronized files on a computer you no longer control.

VERIFY: Remember that a synchronized OneDrive folder is also data stored on the device.

Protect OneDrive on your phone

A phone signed in to OneDrive can provide access to your cloud files, especially when the device is unlocked.

Click to see protection steps

Step-by-step

  1. Use a strong phone passcode.
  2. Enable biometric protection where supported.
  3. Keep the operating system updated.
  4. Install OneDrive only through an official app store.
  5. Review downloaded or offline files periodically.

VERIFY: Confirm that someone who finds your phone cannot immediately access your OneDrive.

Watch for Microsoft phishing messages

Attackers frequently imitate Microsoft security alerts to steal passwords, authentication codes or session information.

Click to see protection steps

Step-by-step

  1. Be suspicious of unexpected messages claiming your Microsoft Account is locked, suspended or expiring.
  2. Do not sign in through a suspicious link.
  3. Check the actual website address before entering credentials.
  4. Open your Microsoft Account directly when checking security status.
  5. Never give an authentication code to someone who unexpectedly asks for it.

VERIFY: Verify the alert independently before entering your Microsoft credentials.

Review connected applications

Third-party applications can receive permissions to interact with Microsoft services. Remove access that is no longer needed.

Click to see protection steps

Step-by-step

  1. Open your Microsoft Account's Privacy or Securitysettings.
  2. Review connected applications and services.
  3. Identify applications you no longer use.
  4. Remove unnecessary permissions.
  5. Investigate unfamiliar applications before trusting them.

VERIFY: Every application with access to your Microsoft Account should have a purpose you recognize.

Understand OneDrive file recovery

OneDrive provides tools for recovering files after accidental deletion or other problems. Recovery is easier when you act quickly.

Click to see protection steps

Step-by-step

  1. Check the OneDrive Recycle Bin when a file is accidentally deleted.
  2. Review available version history for files that were changed incorrectly.
  3. For broader incidents, review Microsoft's available OneDrive restore options.
  4. Act quickly when you discover unwanted changes.

VERIFY: Know where OneDrive recovery tools are located before you need them.

Prepare for ransomware

Ransomware can affect synchronized files on computers. OneDrive provides recovery features that can help restore files after an incident.

Click to see protection steps

Step-by-step

  1. Keep Windows and security software updated.
  2. Avoid opening unexpected attachments or links.
  3. Do not install unknown software.
  4. Keep important files protected by appropriate OneDrive recovery options.
  5. If ransomware strikes, disconnect the affected device from networks when appropriate and begin incident response.
  6. Do not automatically assume that paying an attacker will recover your files.

VERIFY: Your important files should have a recovery path that does not depend on trusting a criminal.

Back up irreplaceable files

Cloud storage is valuable, but important information should not depend on one account or one provider alone.

Click to see protection steps

Step-by-step

  1. Identify documents and photographs you cannot afford to lose.
  2. Keep appropriate copies in another secure location.
  3. Protect the backup with strong access controls.
  4. Periodically verify that the backup can actually be opened.
  5. Keep at least one backup separated from the primary account.

VERIFY: Ask yourself: if my OneDrive account became unavailable today, would I still have a safe copy of my most important files?

If your Microsoft Account may be compromised

A compromised Microsoft Account can expose OneDrive as well as Outlook, contacts, Office documents and other Microsoft services.

Click to see protection steps

Step-by-step

  1. Move to a trusted device.
  2. Change your Microsoft Account password.
  3. Review two-step verification.
  4. Review recent sign-in activity.
  5. Review connected devices.
  6. Remove suspicious applications and permissions.
  7. Review OneDrive sharing permissions.
  8. Change passwords for other important accounts if their recovery information was exposed.

VERIFY: Do not stop after changing your Microsoft password. Review the entire account and the files it protects.

If your computer or phone is lost

A lost device may contain synchronized OneDrive files or an active Microsoft session.

Click to see protection steps

Step-by-step

  1. Use Microsoft's available device-security and account controls.
  2. Review the lost device in your Microsoft Account.
  3. Secure or remove the device where appropriate.
  4. Change your Microsoft Account password if you believe the device was accessed.
  5. Review recent sign-in activity.
  6. Check whether sensitive OneDrive files were stored locally.

VERIFY: Treat a lost device containing synchronized files as a cloud-security incident.

Something does not look right?

If you find an unfamiliar login, changed recovery information, unexpected security alerts or another sign that someone may have accessed your account, stop the normal security check and move to the recovery process.

I think my account is compromised →
Still need help?

If you have worked through the relevant settings and something still looks wrong, do not give your security secrets to someone promising to fix the account. Use the service's official support and recovery resources for service-specific account problems.

For broader cybersecurity problems, you can also use the professional assistance pathway on this platform.

Need Professional Help? →
OneDrive security is not a one-time task.

Review important account settings periodically, especially after a password change, device change, suspicious message or unexpected login alert.

VERIFY BEFORE YOU TRUST.

← Back to Secure Your Accounts