Cloud Storage & File Sharing
Microsoft OneDrive for Business
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Microsoft Corporation · learn.microsoft.com
Compare with Nextcloud Files (Nextcloud Hub) → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Microsoft OneDrive for Business at a glance
- Vendor
- Microsoft Corporation
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Microsoft OneDrive for Business 3/5, the mean of 6 judges. OneDrive for Business is Microsoft's cloud storage and file sharing service inside Microsoft 365 plans. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Microsoft OneDrive for Business alternatives, European ones first →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
OneDrive for Business is Microsoft's cloud storage and file sharing service inside Microsoft 365 plans. Its strongest score is administration and governance, holding at 7 on Purview retention policies, eDiscovery holds, records with proof of disposition for up to seven years and data loss prevention conditions. Sharing and collaboration and encryption and security follow at 6-7, the first on administrator-enforced Anyone-link expiry, view-only restriction and domain lists of up to 5,000 entries, the second on AES 256 per-file keys exclusive to a single tenant, TLS in transit and a FIPS 140-2 Level 2 validated process. Pricing transparency is weakest at 2-3: storage per plan is published — 1 TB per user, 2 GB on F3 — but no monetary price appears on the captured pages. Sovereignty scores 4-5, since EU and EFTA residency requires an EU or EFTA sign-up, is forfeited when Multi-Geo is purchased, and limited transfers outside the boundary continue. Sync and access spans 4-6, the widest spread, with no public information on a Linux client, open protocols or file size limits.
Speaks for it
- Administration and governance scores hold at 7 on Purview retention policies, eDiscovery holds, records with proof of disposition for up to seven years and data loss prevention conditions
- Sharing controls are administrator-enforced, with forced expiry on Anyone links, view-only restriction, allow and block domain lists of up to 5,000 domains and automatic guest access expiry
- Encryption is documented in depth — AES 256 at rest with per-file keys exclusive to a single tenant, TLS in transit, a FIPS 140-2 Level 2 validated process and an optional Customer Key in Azure Key Vault
- The Microsoft Graph API is documented with SDKs, webhooks, a delta synchronization API, a file picker SDK and PowerShell automation
- Windows and Mac sync apps with Files On-Demand and Known Folder Move, plus iOS and Android apps, are documented, alongside a 93-day recycle bin and restore to any point over the past 30 days
Held against it
- No monetary price for any plan appears on the captured pages, so an annual cost cannot be computed from what is public
- EU and EFTA residency requires an EU or EFTA sign-up, is forfeited when Multi-Geo is purchased, and limited transfers outside the boundary continue
- We found no public information on a Linux client, open protocols such as WebDAV, SFTP or S3, block-level sync or file size limits
- We found no public information on bulk export with folder structure and versions, migration tools from a named provider, or a self-hosted edition
- We found no public information on end-to-end encryption, an independent audit, or ISO 27001, SOC 2 or BSI C5 certification on the captured pages
Best for
- You already run Microsoft 365 and need retention policies, eDiscovery holds and records with proof of disposition for up to seven years to show an auditor
- You share files with outside clients and partners and want administrator-enforced link expiry, view-only Anyone links and domain allow and block lists of up to 5,000 domains
- Your developers build inside the Microsoft stack and want a documented REST API with SDKs, webhooks and a delta synchronization API
- Your staff work on Windows and Mac machines with iOS and Android phones, and Files On-Demand and Known Folder Move fit that footprint
Avoid if
- You need to compute an annual cost from public prices before committing — ask the vendor: the public pages we read do not show it
- You require unconditional European residency — the EU Data Boundary applies only with an EU or EFTA sign-up, is forfeited when Multi-Geo is purchased, and admits limited transfers outside the boundary
- You need shared departmental or organizational storage — OneDrive is provisioned per user, and storing departmental and organizational level data, including system backups, is not supported
- Your toolchain depends on a Linux client or drive-letter access — the documented sync clients cover Windows, Mac, iOS and Android
The scores
| Criterion | Panel median |
|---|---|
| Sync, clients & file access | 2.5 of 5 |
| Sharing & external collaboration | 3.5 of 5 |
| Encryption, key custody & recovery | 3.5 of 5 |
| Administration, audit & governance | 3.5 of 5 |
| Export, API & self-hosting | 3 of 5 |
| European sovereignty | 2.5 of 5 |
| Pricing transparency | 1.5 of 5 |
Sync, clients & file access
Show reasoningHide reasoning
How this is scored
How files reach the people who work with them: desktop clients for Windows, macOS and Linux, files on demand (virtual drive) and selective sync, offline access, mobile apps with camera upload and offline folders, a web interface, block-level or delta sync for large files, sync of folders outside the main folder, file size limits, preview of common formats, full-text search, and access through open protocols (WebDAV, SFTP, S3) or a mounted network drive.
0 — Not a file storage or sync product; files cannot be stored and synced with it.
3 — A web interface and apps for some platforms to upload and download files; desktop sync, files on demand, offline access and limits are basic or not described.
5 — Desktop sync clients for Windows and macOS, files on demand or selective sync, mobile apps with offline files and camera upload, a web interface with previews, file size limits stated, and search by file name.
8 — Clients for Windows, macOS and Linux, a virtual drive with files on demand, block-level or delta sync documented, full-text search inside documents, access via WebDAV, SFTP or S3, large-file handling stated, and LAN sync or a performance figure for big folders.
10 — File access that a whole organisation runs on: every platform covered with feature parity stated, sync conflicts and their resolution documented, open protocols and a mountable drive on every desktop, search across content and metadata with OCR, and sync behaviour and limits published in technical documentation.
The IT Lead
Windows and Mac sync apps with Files On-Demand and Known Folder Move for desktop and documents cover most of my 180 users, with iOS and Android apps and web access rounding it out, and previews documented for hundreds of formats. We found no public information on a Linux client, open protocols like WebDAV, SFTP or S3, block-level sync, stated file size limits or search, so I stop at a solid mid rating. 1 2 8
The Data Protection Officer
The Windows and Mac sync apps, files on demand that keeps cloud files visible in File Explorer, Known Folder Move for desktop and documents folders, and iOS and Android apps are documented, which covers how patient letters reach staff machines. We found no public information on a Linux client, block-level or delta sync, open protocols such as WebDAV or SFTP, or file size limits on the captured pages. 1 2 8
The Architecture Practice Partner
Windows and Mac sync apps plus iOS and Android apps are documented, and Files On-Demand — viewing, searching and freeing up space from File Explorer without downloading everything — is exactly what keeps our laptops lean with multi-gigabyte models. We found no public information on a Linux client, on delta or block-level sync, on mobile offline folders and camera upload, or on access through WebDAV, SFTP or S3, which is the drive letter our CAD software would want. 1 2
The Tax Adviser
Windows and Mac sync apps plus iOS and Android apps are documented, with Files On-Demand in File Explorer and Known Folder Move for desktop and documents folders — my staff's machines are covered. However, I found no public information on a Linux client, on access via WebDAV, SFTP or S3, on block-level sync, on file size limits, or on full-text search inside documents, so the evidence reaches a mid level. 1 2 8
The Agency Producer
Windows and Mac sync apps with files on demand, iOS and Android apps, a 30-day whole-drive restore and a 93-day recycle bin are documented, with previews available for hundreds of formats. But we found no public information on a Linux client, block-level sync for large video files, file size limits, or access via WebDAV, SFTP or S3 — which matters when a shoot's raw footage has to move without stalling. 1 2 8
The Skeptic
Windows and Mac sync apps, Files On-Demand, Known Folder Move and iOS and Android apps are documented, with web and mobile feature sets across plans. We found no public information on mobile offline files or camera upload, file size limits, block-level or delta sync, or access via WebDAV, SFTP or S3, so the documented access story stops short of what an organisation runs on. 1 2
Sharing & external collaboration
Show reasoningHide reasoning
How this is scored
How files are shared inside the team and with people outside it: shared team folders or spaces, share links with password, expiry, download limits and view-only or no-download mode, upload links (file requests) for customers, guest or external user accounts, link and access reports, notifications, watermarking, comments and file locking, editing of office documents in the browser together, large-file transfer, and an Outlook or Teams add-in for sending links instead of attachments.
0 — Files cannot be shared with anyone else.
3 — Folders and files can be shared with other users and by public link; link controls, upload links and external accounts are basic or not described.
5 — Shared team folders, share links with password and expiry, view-only links, upload links for external people, permissions per folder (view, edit), notifications on changes, and office documents opened and edited in the browser.
8 — Link policies the administrator sets (forced expiry, passwords, domains allowed), download limits and no-download view, watermarking, guest accounts with their own permissions, an access log per share, file locking and comments, co-editing documented with the editor named, and an Outlook or Teams add-in.
10 — External collaboration at the level of a data room: granular rights including print and download control on shared files, revocation that also reaches copies already opened, recipient identity verification, a complete record of who opened and downloaded what, and end-to-end encryption kept intact when sharing externally and when editing.
The IT Lead
Administrator-set link expiry, domain allow and block lists up to 5,000 domains, view-only anyone links, file requests, and Entra B2B guests with their own permissions and automatic expiry give me real external-collaboration control, and Outlook attachment integration plus guest viewing and editing in Office.com are documented. We found no public information on link passwords, download limits, no-download view, watermarking, or file locking and comments. 3 4 1
The Data Protection Officer
Administrator-set link controls are well evidenced — forced expiry for Anyone links, view-only restriction, allow and block domain lists, guest verification by work, school or Microsoft account or verification code, and automatic guest access expiry — together with file requests and Outlook sharing of links instead of attachments. We found no public information on link passwords, download limits or a no-download view, watermarking, file locking or comments on the captured pages. 1 3 4 11
The Architecture Practice Partner
Anyone links grant view or edit with no login at all, which is precisely how our structural engineers pick up a folder without an account, and administrators can force link expiry, restrict Anyone links to view-only, and allow or block up to 5,000 domains; file requests act as upload links, guests come in via Microsoft Entra B2B and can view and edit documents in Office.com, and Outlook shares files as modern attachments. We found no public information on link passwords, download limits, watermarking, file locking or comments. 3 4 11 1
The Tax Adviser
File requests let my clients upload receipts without an account, Anyone links can be forced to expire and restricted to view-only, domains can be allowed or blocked up to 5,000 entries, guest access expires on an admin-set clock with revocation typically within one hour, and identity verification for new guests is documented. Password-protected links, download limits and no-download view are not described, and the record of who opened or downloaded what appears only as viewer information retained for administrator audit — close to data-room practice, but not all of it is on the page. 1 3 4
The Agency Producer
This covers much of what I need for client review: admin-enforced expiry on open links, view-only links, allow and block domain lists of up to 5,000 domains, file requests for uploads, verified guest accounts editing in the browser via Office, viewer info recorded for audit, link revocation, and an Outlook attachment integration. We found no public information on download limits, a no-download view, watermarking, or file locking and comments on files. 1 3 4 11
The Skeptic
Administrator-set link policy is real: forced expiry and view-only restriction on Anyone links, domain allow and block lists up to 5,000 entries, timed guest access expiry with revocation typically within one hour, identity verification for new guests, and file requests for uploads; guests view and edit in Office.com and Outlook shares OneDrive files as attachments. We found no public information on link passwords, download limits, no-download viewing, watermarking, file locking or comments, which keeps this below the top tier. 1 3 4 11
Encryption, key custody & recovery
Show reasoningHide reasoning
How this is scored
How the files are protected and restored: encryption in transit and at rest, client-side or end-to-end encryption and whether it covers all folders, sharing and office editing, who holds the keys and what happens when a user loses theirs, customer-managed keys, two-factor authentication and single sign-on, version history and its length, a recycle bin, restore of a whole folder or account to a point in time after ransomware, ransomware detection, malware scanning, an independent security audit or penetration test, a bug bounty, and certifications (ISO 27001, SOC 2, BSI C5) with their scope. Where the data is stored is scored under sovereignty.
0 — Files are stored without any stated encryption and no account protection beyond a password.
3 — Encryption is mentioned and a recycle bin or version history exists; key custody, two-factor, restore after ransomware and audits are basic or not described.
5 — TLS in transit and AES encryption at rest stated, two-factor authentication, version history with its length stated, a recycle bin, the restore of deleted or overwritten files, and a security page naming at least one certification or audit.
8 — Client-side or end-to-end encryption documented with who holds the keys (or customer-managed keys), a whitepaper describing the scheme, single sign-on (SAML), restore of a folder or account to a point in time, ransomware detection or recovery documented, an independent audit or penetration test named, and ISO 27001, SOC 2 or BSI C5 stated with scope.
10 — Security that can be verified: zero-knowledge end-to-end encryption by default that stays on for sharing and editing, the cryptography published and externally audited with the report available, key recovery for organisations documented without the provider gaining access, open-source clients or a public bug bounty, and certifications published with their scope and date.
The IT Lead
The encryption documentation is deep: AES 256 with unique per-file keys exclusive to my tenant, the process FIPS 140-2 Level 2 validated, and a documented Customer Key hierarchy in Azure Key Vault; the 93-day recycle bin and Files Restore to any point over the past 30 days is exactly the ransomware recovery path I want for a share. We found no public information on end-to-end encryption, ransomware detection, two-factor specifics, or an independent audit or ISO 27001, SOC 2 or BSI C5 certification on the captured pages. 5 1
The Data Protection Officer
AES-256 at rest with unique per-file keys exclusive to one tenant, TLS in transit, FIPS 140-2 Level 2 validated encryption steps, a 93-day recycle bin and whole-drive restore to any point in the past 30 days are documented, and the optional Customer Key held in Azure Key Vault answers who holds the keys. The scheme is server-side, though: we found no public information on end-to-end encryption that survives a share link or browser editing, an independent audit, or ISO 27001, SOC 2 or BSI C5 on the captured pages. 1 5
The Architecture Practice Partner
AES 256-bit per-file keys exclusive to a single tenant, TLS in transit, a FIPS 140-2 Level 2 validated encryption process and a Customer Key hierarchy held in Azure Key Vault are documented in real depth, and Files Restore reaches back 30 days with a 93-day recycle bin. We found no public information on two-factor or single sign-on, on end-to-end encryption, or on a named independent audit or certification such as ISO 27001 or BSI C5. 1 5 10
The Tax Adviser
TLS in transit and AES 256-bit at rest with unique per-file keys, FIPS 140-2 Level 2 validation of the encryption process, a 93-day recycle bin, restore of files to any point over the past 30 days, and Conditional Access with real-time identity risk detection are all documented. For my §203 duty the decisive point: encryption at rest runs inside Microsoft's service, Customer Key in Azure Key Vault is a documented option, and I found no public information on end-to-end encryption that would keep files unreadable to the provider, nor a named independent audit or ISO 27001, SOC 2 or BSI C5 certification with scope on these pages. 1 5 12
The Agency Producer
At-rest protection is unusually well described: per-file AES 256 keys unique to a tenant, a documented key hierarchy with a customer-managed key option in Azure Key Vault, FIPS 140-2 Level 2 validated processes, TLS on every request, plus Conditional Access and real-time identity risk detection. But we found no public information on end-to-end encryption, an independent audit or penetration test, or certifications such as ISO 27001, SOC 2 or BSI C5. 1 5 11 12
The Skeptic
The encryption architecture is published in detail: TLS in transit, AES 256 at rest with unique per-file keys exclusive to a single tenant, a FIPS 140-2 Level 2 validated process, and a Customer Key held in the customer's Azure Key Vault above a tenant, site and file-level key hierarchy, plus Files Restore to any point in the past 30 days and a 93-day recycle bin. We found no public information on end-to-end encryption, two-factor authentication, an independent audit, or ISO 27001, SOC 2 and BSI C5 certifications — the scheme is documented, its external verification is not on these pages. 1 5 9 10
Administration, audit & governance
Show reasoningHide reasoning
How this is scored
What an administrator controls: an admin console with users, groups and roles, provisioning through Entra ID, Google or LDAP with SCIM, quotas per user or team, an audit log of logins, shares and file actions with export, retention policies and legal hold, data loss prevention or classification, device management with remote wipe and unlinking, policies for external sharing, account transfer when someone leaves, team folders that belong to the company rather than to a user, and reports on storage and sharing.
0 — No administration: every account is independent and nobody can manage the team's users or files.
3 — A team plan with an administrator who can invite and remove users; roles, audit log, retention and device controls are basic or not described.
5 — An admin console with users, groups and admin roles, quotas, an activity or audit log, policies for external sharing, file transfer when a user leaves, company-owned team folders, and remote unlinking of lost devices.
8 — Provisioning via SCIM or a directory (Entra ID, Google, LDAP), an exportable audit log covering logins, shares and file actions, retention policies and legal hold, remote wipe, IP or device restrictions, data classification or DLP, and integration with a SIEM.
10 — Governance a regulated organisation can sign off: granular delegated administration per department or tenant, retention and legal hold with eDiscovery export, DLP with content inspection, every admin and user action logged and streamed to a SIEM, and the audit log retention and completeness stated.
The IT Lead
The SharePoint admin center gives quotas, organization-level sharing policy, domain-joined sync requirements and access control from unmanaged devices or by network location, while Purview adds retention policies, eDiscovery hold, records with proof of disposition for up to seven years and DLP with retention labels as conditions — a package I could hand an auditor. Identity and provisioning run through Entra ID with PowerShell, and shared drives live in SharePoint document libraries rather than user accounts, but we found no public information on remote wipe of a lost laptop or audit log export and SIEM streaming, which my two-person shop still needs to see. 1 6 7 12 14
The Data Protection Officer
Retention policies and labels, records with proof of disposition for up to seven years, eDiscovery holds, trainable classifiers, DLP conditions and a Preservation Hold library, plus access control by device management state or network location and 30-day retention of departed users' data, give me most of what a hospital group signs off. The audit trail is only partly evidenced — viewer information stays auditable and label administration is audited — and we found no public information on an exportable audit log of logins, shares and file actions, remote wipe, or SIEM integration on the captured pages. 1 4 6 12 14
The Architecture Practice Partner
Retention policies and eDiscovery holds that block permanent deletion, disposition review, trainable classifiers and DLP conditions, plus Conditional Access limiting unmanaged devices and network locations, reach well into governance territory, and the SharePoint admin center sets per-user storage, sync restrictions and a 30-day default retention for departed users' data. We found no public information on remote wipe, an exportable audit log of logins, shares and file actions, SCIM provisioning by name, or SIEM streaming. 1 6 12 7
The Tax Adviser
The SharePoint admin center covers organisation-level sharing settings, default storage per user, access control by unmanaged device or network location, and retention of deleted users' data (default 30 days), while Purview adds retention policies and labels, eDiscovery hold that blocks deletion, records with proof of disposition for up to seven years, and DLP conditions — deep enough for a practice like mine. Remote wipe, SCIM provisioning verbatim, export of the audit log and SIEM streaming are not described on the captured pages. 1 6 12 14
The Agency Producer
The admin side runs deep: a SharePoint admin center with organisation-level sharing settings and default storage per user, access control from unmanaged devices or by network location, 30-day retention for departed users' data, and Purview retention policies, eDiscovery holds, records with proof of disposition and data loss prevention. We found no public information on an exportable audit log of logins and file actions, SCIM provisioning, remote wipe, or SIEM streaming. 1 4 6 12
The Skeptic
Governance is deep where it counts: an admin console with per-user storage limits and access control by device or network location, deleted-user data retained 30 days by default, organization-level sharing policy, and Purview retention with eDiscovery hold, record declaration, disposition review, trainable classifiers and retention labels usable as a data loss prevention condition. We found no public information on directory or SCIM provisioning, a full exportable audit log of logins and file actions, remote wipe or SIEM streaming. 1 4 6 12
Export, API & self-hosting
Show reasoningHide reasoning
How this is scored
Whether the files and their structure can leave and connect: a bulk export or download of all data with folders and versions, open protocols (WebDAV, S3, SFTP) usable for migration, a documented REST API and SDKs, webhooks, migration tools from Dropbox, Google Drive, OneDrive or a file server, integrations with office suites, Microsoft 365 and Teams, Slack, CRM and project tools, an app marketplace, open-source code, a self-hosted or on-premise edition, and deletion of data on termination.
0 — Files can only be downloaded one by one; no export, API or migration path.
3 — Files can be downloaded in bulk or as an archive; an API, migration tools, integrations and self-hosting are basic or not described.
5 — A documented API, bulk download of all files with the folder structure, a migration path from at least one named provider, integrations with named office and collaboration tools, and what happens to data after cancellation stated.
8 — A REST API with SDKs and webhooks, open-protocol access (WebDAV, S3 or SFTP) that makes migration tool-independent, migration tools in both directions or a supported migration service, an app marketplace, a self-hosted or on-premise edition, and deletion on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete export including versions, shares and permissions in a documented format, and the deletion of every copy and backup on termination documented.
The IT Lead
The Graph API story is first-rate for a Microsoft shop: stable v1.0 REST endpoints, SDKs across.NET, Java, Python and more, webhooks plus a delta API, a file picker SDK and embeddable previews, all documented. We found no public information on bulk export with folder structure and versions, migration tools from a named provider, open protocols like WebDAV, SFTP or S3 for migration, self-hosting, or deletion of data on termination. 8 14 15
The Data Protection Officer
One documented REST API with SDKs, webhooks, a delta query for synchronisation, a file-picker SDK and thumbnails for hundreds of formats, plus Outlook and Teams integration, is genuinely strong connectivity. We found no public information on bulk export with folder structure and versions, a migration path from another provider, open protocols such as WebDAV or S3, a self-hosted edition, or the treatment of data after cancellation on the captured pages. 1 8 14 15
The Architecture Practice Partner
The Microsoft Graph API is documented to a depth we could genuinely build on — SDKs across languages, webhooks, a delta API, a file picker SDK, PowerShell — with named integrations into Excel, Teams, Outlook and OneNote. We found no public information on a bulk export preserving folder structure and versions, on migration tools from a named provider, on open protocols such as WebDAV or S3 for tool-independent migration, or on a self-hosted edition. 8 14 15 1
The Tax Adviser
Connecting is excellent: a documented Microsoft Graph REST API with SDKs across many languages and platforms, webhooks, a delta API, file picker and file handler SDKs, PowerShell, and integrations with Outlook, Teams and Excel. On leaving, I found no public information on bulk export of all files with the folder structure, migration tools from a named provider, open-protocol access, a self-hosted edition, or what happens to the data after cancellation. 1 8 14 15
The Agency Producer
The Microsoft Graph API is genuinely strong — REST with SDKs across many languages, webhooks, a delta API, a file picker SDK, embedded previews and PowerShell automation — and the older Office 365 APIs are explicitly folded into it. But we found no public information on open protocols like WebDAV, SFTP or S3, bulk export with folder structure and versions, migration tools from Dropbox or Google Drive, or a self-hosted edition, so an exit with our archive intact is undocumented. 8 14 15
The Skeptic
Microsoft Graph gives a documented single API for OneDrive with SDKs, webhooks and a delta synchronization API, and Outlook integration is published. But nothing on these pages answers the exit question: we found no public information on bulk export with folder structure and versions, migration tools from named providers, open protocols such as WebDAV or S3, a self-hosted edition, or deletion of data on termination. 1 8 14 15
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where files, metadata and backups are stored and processed, and who the subprocessors are (data centres, CDN, email that carries share notifications, support desk, payment, office editing). Independently sourced by the sovereignty pipeline; files hold the company's documents and personal data, so the whole chain counts, not only the storage. End-to-end encryption with keys only the customer holds reduces what a foreign provider could hand over but does not change who the provider is. A self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, storage location unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the storage location is unstated or non-EU and the subprocessors are not listed.
5 — EU storage available and an EU contracting entity or EU representative, but parts of the chain (account data, metadata, notifications, support, office editing, payment) run through non-EU providers without a stated safeguard, or the parent company is subject to non-EU disclosure laws.
8 — EU storage on named data centres, EU or EEA or Swiss contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or a self-hosted edition documented that keeps every file on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, storage and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
The EU Data Boundary is documented with named datacentre countries including Poland and Germany, and a downloadable Data Protection Addendum dated November 2026 exists, but European storage applies only with an EU or EFTA sign-up location and is forfeited when Multi-Geo is purchased, with limited transfers outside the boundary persisting. The vendor is Microsoft Corporation of Redmond, Washington, and we found no public information on the contracting entity jurisdiction, a subprocessor list with locations, or ISO 27001, SOC 2 or BSI C5 certifications, so I cannot place it higher. 9 7 10
The Data Protection Officer
The EU Data Boundary commitment names EU and EFTA countries for storage and processing and the data protection addendum is downloadable, but residency is conditional on an EU or EFTA sign-up, is forfeited when Multi-Geo is purchased, and the documentation states that limited transfers outside the boundary continue. We found no public information on the contracting entity or on a subprocessor list with locations on the captured pages, and the vendor is a United States corporation in Redmond. 7 9 10
The Architecture Practice Partner
The EU Data Boundary commits to storing and processing customer data inside the EU and EFTA on named datacentres including Germany, and the data protection addendum is published with a November 2026 edition, but the commitment applies only to EU or EFTA sign-ups, is forfeited the moment Multi-Geo is purchased, and limited transfers outside the boundary are still admitted. The contracting vendor is Microsoft Corporation of Redmond, Washington, and we found no public information on subprocessor locations or security certifications, so the chain is conditional rather than end-to-end European. 9 10 7
The Tax Adviser
The EU Data Boundary commits to storing and processing customer data in named datacenter countries including Germany, and the Data Protection Addendum is published and downloadable. But this is a US-headquartered vendor, residency is conditional — forfeited when Multi-Geo is purchased and subject to stated limited transfers outside the boundary — and I found no public information on the contracting entity's jurisdiction or on a subprocessor list with locations, so the chain is only partly evidenced as European. 7 9 10
The Agency Producer
The EU Data Boundary commits to storing and processing customer data in EU and EFTA datacentres across fifteen named European countries, and a downloadable data processing addendum is published — but the vendor is Microsoft Corporation of Redmond, Washington, the boundary's own documentation says data continues to be transferred outside it in limited circumstances and is forfeited entirely if Multi-Geo is purchased, and we found no public information on subprocessor locations or security certifications. 7 9 10
The Skeptic
EU storage is documented and named — the EU Data Boundary lists datacentres in fifteen European countries for customers signed up in the EU or EFTA, and a Data Protection Addendum is published for download. But the boundary is conditional: it follows the sign-up location, is forfeited when Multi-Geo is purchased, and Microsoft itself states data continues to be transferred outside it in limited circumstances; the provider's seat is the United States, and we found no public information on the subprocessor chain. 7 9 10
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per plan, storage included per user or pooled, the minimum number of users, what extra storage costs, which features (end-to-end encryption, SSO, audit log, longer version history, data residency, advanced admin) need a higher tier or an add-on, the free tier and its limits, lifetime offers and their terms, the self-hosted edition's licence and support, minimum term and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, storage or features is unclear.
5 — Business tiers are public with their price per user and storage included, but at least one commonly needed piece (extra storage, SSO, audit log, data residency, minimum users) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, storage), extra storage and add-ons priced, minimum users and term stated, the self-hosted edition's licence and support cost stated, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, storage need and feature set, with every add-on, migration, support and overage fee and the cancellation and data-return terms published.
The IT Lead
Storage allowances per plan are published — 1 TB per user on the Business tiers and E3 and E5, expandable to 5 TB, and 2 GB per user on F3 — and a 30-day free trial and a free renewable developer subscription exist, but no price per user in any currency appears on the captured pages, extra storage means working with a Microsoft representative, and minimum users, term and VAT treatment are not stated. As a buyer I cannot compute our real annual cost from what is public here. 2 7 12
The Data Protection Officer
Storage per user is published per plan — 1 TB, rising to 5 TB on E3 and E5, 2 GB on F3 — and a 30-day free trial exists, but no monetary price for any plan appears on the captured pages. Additional tenant storage is a matter for 'your Microsoft representatives' and Multi-Geo is described only as a licensing percentage rule, so an annual cost cannot be computed from these pages. 2 7 12
The Architecture Practice Partner
The plan structure and storage are public — 1 TB per user on the business plans, E3 and E5 expandable to 5 TB, F3 at 2 GB, Multi-Geo as a user-level add-on licensed for at least 5% of eligible users — and a free 30-day trial exists. No price figure appears on the captured pages, so I cannot compute what a 25-person practice would actually pay per year. 2 7 12
The Tax Adviser
Storage per plan is public — 1 TB per user on the business plans and E3/E5, increaseable to 5 TB on E3/E5, 2 GB on F3 — and the Multi-Geo add-on carries a stated licensing rule of at least 5% of eligible users through Enterprise Agreement, Web Direct or CSP, with a free 30-day trial available. But I found no public per-user prices in currency on the captured pages, additional tenant storage goes through a Microsoft representative, and minimum term and VAT treatment are not stated, so I cannot compute an annual cost for eleven staff from these pages. 2 7 12
The Agency Producer
Storage per plan is public — 1 TB per user on the Business and E plans, increaseable to 5 TB on E3 and E5, 2 GB on F3 — and a 30-day free trial plus a free renewable developer subscription exist. But no price per user appears on any captured page, additional tenant storage means talking to a Microsoft representative, and the Multi-Geo residency add-on is sold only through Enterprise Agreement, Web Direct or CSP with a 5% licensing minimum — I cannot compute a year's bill for my team from public pages. 2 7 12 14
The Skeptic
Storage allocations are public — 1 TB per user on E3 and E5, increasable to 5 TB, 2 GB per user on F3 — and the Multi-Geo add-on's licensing rule is stated as a license per satellite user at a minimum of 5% of eligible users, plus a free 30-day trial. But we found no public information on any per-user price, extra storage cost, minimum term or VAT treatment, so an annual cost cannot be computed from these pages. 2 7 12
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Microsoft OneDrive for Business
Is Microsoft OneDrive for Business European?
No. whats-best.ai classifies Microsoft OneDrive for Business as Rest of world.
Where does Microsoft OneDrive for Business store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Microsoft OneDrive for Business have a free plan?
Yes. Microsoft OneDrive for Business has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Microsoft OneDrive for Business?
As of 1 Nov 2026, the panel rates Nextcloud Files (Nextcloud Hub) (4/5), Tresorit (3.5/5) and Proton Drive (3/5) highest among the other 13 Cloud Storage & File Sharing products evaluated. The highest-rated European alternative is Nextcloud Files (Nextcloud Hub) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Microsoft OneDrive for Business alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Hosting location, Hosting options, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (16)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Product documentation (overview) learn.microsoft.com Checked 1 Nov 2026 Details →
- 2 Service description (features and plans) learn.microsoft.com Checked 1 Nov 2026 Details →
- 3 Product documentation (external sharing) learn.microsoft.com Checked 1 Nov 2026 Details →
- 4 Product documentation (sharing settings) learn.microsoft.com Checked 1 Nov 2026 Details →
- 5 Security documentation (encryption) learn.microsoft.com Checked 1 Nov 2026 Details →
- 6 Product documentation (retention) learn.microsoft.com Checked 1 Nov 2026 Details →
- 7 Product documentation (Multi-Geo data residency) learn.microsoft.com Checked 1 Nov 2026 Details →
- 8 API documentation learn.microsoft.com Checked 1 Nov 2026 Details →
- 9 EU Data Boundary documentation learn.microsoft.com Checked 1 Nov 2026 Details →
- 10 Data protection addendum www.microsoft.com Checked 1 Nov 2026 Details →
- 11 Sharing & external collaboration — found from sitemap learn.microsoft.com Checked 1 Nov 2026 Details →
- 12 Administration, audit & governance — found from sitemap developer.microsoft.com Checked 1 Nov 2026 Details →
- 13 Administration, audit & governance — found from sitemap developer.microsoft.com Checked 1 Nov 2026 Details →
- 14 Export, API & self-hosting — found from sitemap developer.microsoft.com Checked 1 Nov 2026 Details →
- 15 Export, API & self-hosting — found from sitemap learn.microsoft.com Checked 1 Nov 2026 Details →
- 16 Legal notice www.microsoft.com Checked 1 Nov 2026 Details →