OneDrive Versioning vs Backup: What Enterprise Licences Actually Cover

Last reviewed: 2026-03-30 · Microsoft Negotiations

OneDrive's version history is one of the most misunderstood features in enterprise Microsoft licensing. IT teams assume it provides backup — it doesn't. Legal teams assume retention policies protect it — they protect access, not recoverability. The result is a coverage gap that 47% of organisations discover during an actual recovery event rather than before. Here's what your current licences actually provide, what they don't, and what it costs to close the gap.

What OneDrive Version History Actually Does

OneDrive's version history is a feature that records file changes, not file snapshots. This distinction matters enormously when you're designing a recovery strategy. When a user modifies a document — say, 30 edits in a Word file — each edit can create a version entry, but only if the application registers it as a discrete save event. Continuous sync-based edits may consolidate into fewer version entries.

Default Configuration & Limits

• Retention window: 180 days for OneDrive for Business (configurable via SharePoint admin centre)
• Version cap: Maximum 500 versions per file (configurable, but 500 is the hard ceiling)
• Scope: OneDrive for Business ONLY — personal OneDrive subscriptions follow different retention rules
• Access: File owner can view and restore versions; IT admins can restore on behalf of users

What Version History Does NOT Cover

Understanding the gaps is as critical as understanding the feature itself:

• Deleted folder structures: If a user deletes a folder containing 500 files, file versions survive, but the folder hierarchy is lost. Recovery requires manual reconstruction or third-party tooling.
• Files deleted past recycle bin windows: First-stage recycle bin retains deleted files for 30 days; second-stage holds them for 93 days. After that window closes, version history cannot recover the file itself — only files that existed in other versions.
• OneDrive Sync conflicts: When Sync clients conflict (e.g., simultaneous edits on desktop and web), the losing version may be overwritten without creating a versioned copy. The "sync conflict" file is created, but the original may be irretrievable.
• Ransomware attacks that generate new versions: Modern ransomware encrypts files and creates encrypted versions while deleting the original. If the ransomware generates hundreds of version entries, the oldest clean versions may be automatically purged by the 500-version-per-file cap.

Ransomware and the Version History Trap

Modern ransomware campaigns targeting OneDrive operate in stages. The attacker exfiltrates data first (the real objective), then encrypts files as a pressure mechanism. The encryption method matters:

1. Ransomware creates encrypted copies of files while leaving originals intact
2. Originals are then deleted
3. Users see encrypted versions as "current" and unencrypted versions (if any survive) in version history
4. If the ransomware generates more than 500 version entries per file, the oldest clean versions are automatically discarded

OneDrive Files Restore: The Built-In Recovery Tool

Microsoft includes OneDrive Files Restore with M365 E3, E5, and Business licences at no additional cost. This tool detects mass file changes and allows point-in-time recovery up to 30 days. For ransomware scenarios, this is the primary rapid-recovery mechanism — it reverts the entire OneDrive to a state before encryption occurred.

The limitation: Files Restore uses version history infrastructure. If ransomware has generated more than 500 version entries per file, or if the version window has exceeded 30 days, Files Restore cannot recover to that point.

Risk Assessment for Large Organisations

A 10,000-user organisation with 8GB average consumed OneDrive per user = approximately 80TB of data. A sophisticated ransomware variant that generates 600 version entries per file across 50,000 files would exhaust the 500-version cap on many files, orphaning clean versions before Files Restore could execute. This is a real attack vector.

OneDrive Storage Licensing: What You're Actually Paying For

OneDrive storage allowances vary by licence SKU, but the real lever for cost is how organisations pool and allocate that storage. Here's the breakdown:

Storage Pooling: The Licensing Reality

Microsoft pools all user storage allocations into a single tenant-wide reserve. A 1,000-user organisation with M365 E3 licences has 1TB per user (1,000TB) + 10GB × 1,000 (10TB) = 1,010TB total. Actual usage matters far more than the per-user allocation for licensing audit purposes. If only 600TB is consumed, the organisation is not exceeding its allocation. This flexibility is valuable during negotiations — organisations with lower-than-expected consumption can negotiate carve-outs for capacity-based pricing.

Microsoft 365 Backup for OneDrive

Microsoft 365 Backup is a separately licensed add-on ($0.15/GB/month of protected OneDrive data) that provides purpose-built backup recovery independent of version history limits. It offers granular, admin-controlled recovery at file, folder, or full-OneDrive scope with a 30-day restore window and 10-minute backup frequency.

Cost Model: Real Numbers for 1,000 Users

Scenario: 1,000-user enterprise, 8GB average OneDrive consumption per user (typical; most users don't exceed 50GB even with 1TB allocation).

What M365 Backup Adds Over Files Restore

• Faster granular recovery: Restore individual files or folders without rebuilding the entire OneDrive
• Admin-initiated recovery: IT admins can recover on behalf of users without user involvement or knowledge — critical for compliance scenarios
• Backup state visibility: Dashboard showing backup status per user, enabling risk assessment and audit trails
• Independence from version history: Not limited by 500-version cap or 180-day retention window

Microsoft 365 Archive for OneDrive

Archive ($0.05/GB/month) is a cold storage tier designed for inactive or compliance-held OneDrive content. The primary use case is former employee data retention.

The Licensing Trap: Deleted User OneDrive Retention

When a user is deleted from M365, their OneDrive is retained for 30 days by default before permanent deletion. If a compliance hold is placed, this extends to 365 days — only if a valid licence remains assigned to the account. After 365 days or licence removal, data is permanently deleted with no recovery option.

Many organisations retain deleted user licences indefinitely to preserve OneDrive data — this is expensive. Archive offers a cost-effective alternative.

Cost Comparison: 500 Former Employees, 5GB Average

For multi-year retention (e.g., 7-year legal hold), the Archive cost advantage compounds significantly. A single EA negotiation focused on quantifying legacy data volumes and proposing Archive as a standard practice can unlock substantial savings.

Retention Policies vs. Backup: A Critical Distinction

This is where organisations and legal teams frequently become confused. Retention policies are not backup.

Purview Retention Policy Behavior on OneDrive

When a Purview (formerly Compliance) retention policy applies to OneDrive:

• Items the user deletes are moved to the Preservation Hold Library (hidden from the user)
• The Preservation Hold Library is not accessible to users for normal recovery
• Items are preserved for eDiscovery, compliance audits, and legal holds
• But a user cannot say "restore my accidentally deleted file from 6 months ago" — they must go through IT, who must provide eDiscovery access

Backup vs. Retention: Complementary, Not Redundant

Regulated industries (healthcare, finance, legal) require both:

• Retention: Compliance with retention schedules and legal holds
• Backup: Operational recovery from user error, ransomware, or accidental deletion

If a user deletes a file and it's past the recycle bin window, retention policies will preserve it in the hold library for legal purposes — but that file is still unrecoverable for operational use unless you have backup. Backup solves the operational problem; retention solves the compliance problem.

Third-Party Backup Tools: When They Make Sense

Microsoft 365 Backup is not the only option. Here's how the major alternatives compare:

• Veeam Backup for M365: Per-user licence model; covers OneDrive alongside Exchange and Teams; same 30-day restore window as M365 Backup, but with more granular admin reporting and audit trails. Typical cost: $4–$6/user/month.
• AvePoint: Strongest for item-level metadata restoration and governance workflows; integrates deeply with SharePoint lifecycle. More expensive; best for organisations managing thousands of sites.
• Druva inSync: Cloud-native approach covering OneDrive plus endpoint backup (Windows/Mac) in a single licence (~$4/user/month all-in). Useful if you're backing up both OneDrive and local drives.

When Third-Party Wins

• Complex compliance workflows requiring detailed audit trails beyond Microsoft's offering
• Multi-platform coverage needed (OneDrive + endpoints + SharePoint in a single tool)
• Existing investment in third-party backup infrastructure; consolidation justifies tooling cost
• Restore performance requirements tighter than Microsoft's 10-minute RPO

For most organisations, Microsoft 365 Backup is sufficient and simpler to manage operationally.

Negotiation Tactics

Your leverage in backup and archive licensing conversations centers on consumption commitment and volume consolidation:

M365 Backup Pricing Negotiation

Microsoft's list price is $0.15/GB/month on consumption. Your negotiating position: Commit to a minimum monthly data volume in exchange for a tiered rate. For example:

• First 5TB/month: $0.12/GB (20% discount)
• 5–10TB/month: $0.10/GB (33% discount)
• Above 10TB/month: $0.09/GB (40% discount)

This commitment model gives Microsoft predictability and gives you pricing certainty. Volume growth is assumed annually (10–15%); the discount tier adjusts as consumption increases, but the base rate is locked.

Archive as a Licence Displacement Strategy

If you're currently retaining former employee licences for compliance, quantify the annual cost and present Archive as a replacement:

• Current state: 500 users × $10/month = $60,000/year
• Proposed state: Move to Archive, remove licences, $1,500/year
• Savings: $58,500/year available for other EA needs

This creates a negotiation point in your EA renewal conversation. You're not asking for a discount on Archive (the price is already attractive) — you're asking Microsoft to recognize the licence displacement value and reinvest that $58,500 elsewhere in your agreement (e.g., compliance tools, developer licences).

E5 Compliance Overlap Consideration

If you're already purchasing M365 E5 with Purview compliance, audit whether you need M365 Backup or if retention policies alone meet your operational recovery SLAs. For most organisations, both are needed — but the conversation should happen explicitly rather than default-buying both.