About this article: AI-assisted writing, reviewed against the cited sources. This is source research, not a lab validation of the procedures. Check the stated versions and your own recovery requirements before making changes.
For many organisations, OneDrive is the first and only protection on staff laptops and desktops. Microsoft encourages this. Its admin guidance recommends redirecting Windows "known folders" into OneDrive, and gives as one reason that saving files to OneDrive backs up your users' data in the cloud and gives them access to their files from any device.
That can help with a device-loss incident: a laptop that is lost, stolen or dead. The user signs in on a new device and their documents are there.
But a backup is judged by what it can bring back after the worst day, not the most common one. OneDrive is built to keep copies in step, and some of the things you most need to recover from also stay in step. This article sets out what Known Folder Move protects, where Microsoft documents its limits, and what an organisation should add or decide so that its endpoint recovery plan has no surprises.
It does not argue against Known Folder Move. In our view it is a sensible default for Windows endpoints. The point is to know what it is.
What Known Folder Move does
Known Folder Move redirects a user's familiar Windows folders into their OneDrive, so that files saved in the usual places are synced to the cloud. Microsoft lists the folders as Desktop, Documents, Pictures, Screenshots, and Camera Roll. Users carry on saving where they always have.
Admins can turn it on with Group Policy, Intune administrative templates or registry settings. Users can also do it themselves from the sync app's settings, which Microsoft describes as the Backup tab and Manage backup. The vocabulary in the product itself, in other words, is "backup".
Microsoft's page notes a few conditions that matter for planning:
- Known Folder Move doesn't work for users syncing OneDrive files in SharePoint Server. It is a Microsoft 365 cloud feature.
- The OneDrive policies don't work if the same folders were earlier redirected elsewhere with Windows Folder Redirection, and they don't affect the Music and Videos folders.
- If a user's folders are already redirected to OneDrive in a different organisation, redirecting to yours creates new, empty folders, and the user sees an empty desktop until files are moved by hand.
Limit 1: sync copies the bad change too
A sync service exists to make every copy look the same. When a user deletes a folder on their laptop, OneDrive deletes it in the cloud. When ransomware encrypts files on the laptop, OneDrive uploads the encrypted versions.
That is by design. What protects you is not the sync but the recovery features behind it. Microsoft's support page on restoring deleted files names the main ones and their windows:
- Recycle bin. For personal accounts, you can restore files or folders deleted within the last 30 days. For work or school accounts, you can restore files or folders deleted within the last 93 days, unless your administrator changed the retention setting.
- Previous versions and whole-OneDrive restore. Microsoft 365 subscribers can restore a previous version of a file and use the restore your entire OneDrive feature to roll back everything, to any point in the last 30 days.
- Ransomware detection. Microsoft describes a guided workflow that notifies the user when Microsoft 365 detects an attack, asks them to use antivirus software to clean all your devices before restoring, and then restores the OneDrive to the detection time. This is a Microsoft 365 subscriber workflow; Microsoft says a non-subscriber’s first notification and recovery is free.
The same restore page sets out the limits in plain words. You can only restore items that were located in your own OneDrive, not files that someone else shared with you. And you can't restore anything after they've been permanently deleted from the OneDrive recycle bin.
In our reading, this gives OneDrive a recovery horizon of roughly a month for "roll everything back", and about three months for individual deleted items in a work or school account. Damage that is noticed later, such as a file quietly overwritten in March and needed in August, falls outside the whole-OneDrive rollback. Whether it can still be recovered from version history depends on how many versions the library keeps. Version history limits are set by administrators at organisation, site, library or OneDrive level, as Microsoft's version history limits page explains.
Our recommendation is to find out, for your tenant, what the recycle bin retention and version limits actually are, and write the resulting recovery horizon into your endpoint plan.
Limit 2: it covers some folders, not the device
Known Folder Move covers named folders. Everything else on the device sits outside it unless the user keeps it inside OneDrive by choice. In our reading of the folder list, that includes:
- Folders outside the user profile's known folders. A
C:\Datafolder, a project folder at the root of a drive, or files saved by an application into its own location. - Music and Videos, which the policies do not touch.
- Application settings and local data held elsewhere in the user profile.
- The device itself: Windows, installed applications, drivers, and device-level settings.
Two specific file types behave differently, according to Microsoft's restrictions and limitations page:
- Outlook PST files are supported, but the sync app syncs them less frequently than other file types to reduce network traffic. A PST saved into Documents is not protected as promptly as a Word file in the same folder.
- OneNote notebooks have their own sync mechanism outside of OneDrive. Microsoft says that moving an existing notebook into a synced folder without going through OneNote isn't currently supported.
The same page lists names that are not allowed, such as desktop.ini and file names starting with ~$, and invalid characters. Files that cannot sync stay on the device only.
For most staff, losing the device itself is an inconvenience rather than a disaster, because a modern device can be rebuilt and their files come back from OneDrive. Our view is that the gap matters most for the minority of users, such as engineers, designers, finance staff with local databases and anyone with specialised software, whose important work does not live in Documents.
Limit 3: OneDrive belongs to a user account, and accounts end
A user's OneDrive is tied to their account. When the account goes, so does the OneDrive, on a timetable Microsoft documents in its OneDrive retention and deletion page:
- The cleanup process begins when the user account is deleted from Microsoft Entra ID. Microsoft says that no other action causes the cleanup process to occur, including blocking the user from signing in or removing the user's license.
- By default, the user's manager is given access, and the default OneDrive retention period is 30 days, which administrators can change. A reminder is sent seven days before it ends.
- After that, the OneDrive moves to the site collection recycle bin, where it's kept for 93 days. Restoring it from there needs PowerShell.
- Separately, OneDrive accounts without a valid licence are automatically archived on their 93rd unlicensed day. Microsoft says retention settings and holds are honoured in paid archive, but after 12 months of unpaid storage/archive the data might be deleted regardless of retention settings, policies, eDiscovery or holds. Confirm current billing and retention status before relying on it.
- Microsoft 365 retention policies and labels take precedence over the standard deleted-user process, so content can be kept for longer, or deleted sooner, depending on how they are set. That does not remove the separately documented unpaid-archive deletion risk.
In our reading, the practical risk is the slow-burn case. A staff member leaves, their account is deleted on schedule, and months later someone needs a file that lived only on that person's Desktop. Unless a retention policy kept it, or someone copied it out during the retention window, it may be gone.
Limit 4: one provider, one tenant
Known Folder Move keeps the working copy and the protected copy inside the same Microsoft 365 tenant. If the tenant itself suffers an incident, such as a compromised administrator account, a mass deletion or a mistaken retention change, the files and their recovery options are affected together.
Microsoft offers a separate, paid product for this case. Its Microsoft 365 Backup overview describes it as meant for ransomware attacks and accidental or malicious deletion or overwrite. It says the backups are immutable unless expressly deleted by the Backup tool admin via product offboarding, and lists recovery points every 10 minutes for the previous two weeks, then weekly through a configured window of up to 10 years. For OneDrive, the documented window can be three months, six months or a whole number of years from one to ten; existing policies and artifacts default to one year. Microsoft describes it as a pay-as-you-go offering charged by consumption. We mention it to show that Microsoft itself treats long-term, immutable recovery as a separate need from OneDrive's built-in features. Third-party products also address the same need. This article does not compare them.
What to decide, and what to add
These are our recommendations, which follow from the limits above rather than from a single Microsoft procedure.
Decide what Known Folder Move is in your plan. In our view it is the right tool for device loss and for day-to-day "I deleted the wrong file". It is not, on its own, a long-term or tenant-independent backup. Write that down so nobody assumes more.
Find your real recovery horizon. Check the recycle bin retention, version history limits and any retention policies in your tenant. Those, not the word "backup" in the app, set how far back you can go.
Find the users whose work lives outside known folders. Ask, or inventory common locations, and either move that work into OneDrive or protect those devices another way.
Treat PST files and OneNote with care. Move away from PST files where you can. Make sure notebooks are created in OneDrive through OneNote itself.
Build leaver handling into the process. Before an account is deleted, decide what of that person's OneDrive the organisation needs to keep, and move it or protect it with a retention policy within the documented window.
Protect the device separately if rebuild time matters. If a device must be back in minutes rather than hours, a device image or a fast rebuild process is a separate requirement from file protection.
Decide whether you need a copy outside the tenant or beyond 30 days. That is a risk decision for the business. Microsoft's own separate backup product exists because the built-in features do not cover every case.
Test a restore. Restore a deleted folder from the recycle bin, a previous version of a file, and, on a test account, a whole-OneDrive rollback. Note how long each takes and who has to do it.
Match the recovery question to the actual account
A useful readiness review starts with one named device and one named work account. Confirm which known folders actually moved, which files remain outside them, and whether the sync client reports unresolved errors. Then identify who can recover the account if its owner is unavailable, and which administrator can restore a deleted user’s OneDrive. These are separate checks from confirming that a file appears in the web interface.
Record the tenant’s configured version-history and retention settings rather than treating a product maximum as the organisation’s retention promise. If Microsoft 365 Backup is purchased, record its policy, protected accounts, retained recovery points and available restore granularity separately from OneDrive’s ordinary recovery features. A rehearsal should recover a selected file and confirm its content and access permissions. Restoring an endpoint also requires applications, local data, device configuration and credentials outside Known Folder Move; the folder feature does not supply those pieces.
Risks and limits of this article
- It relies on Microsoft's documentation as it read on 11 November 2026. Retention defaults, folder lists and restore windows have changed before and may change again.
- Retention policies, holds and administrator settings in a given tenant can override the defaults described here.
- It does not test or compare third-party backup products.
- No steps were carried out for this article.
Sources
Writer research: 11 November 2026. Independently reopened for review: 13 November 2026.
- Microsoft Learn: Redirect and move Windows known folders to OneDrive
- Microsoft Support: Restore deleted files or folders in OneDrive
- Microsoft Support: How to detect ransomware and recover files using OneDrive
- Microsoft Support: Restrictions and limitations in OneDrive and SharePoint
- Microsoft Learn: OneDrive retention and deletion
- Microsoft Learn: Version history limits for document library and OneDrive
- Microsoft Learn: Microsoft 365 Backup overview
This article was originally published on .