# Microsoft OneDrive for Business — Cloud Storage & File Sharing

Microsoft OneDrive for Business by Microsoft Corporation holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-01. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Microsoft Corporation (https://learn.microsoft.com/en-us/sharepoint/onedrive-overview)
- Category: [Cloud Storage & File Sharing](https://whats-best.ai/software/cloud-storage.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/cloud-storage/microsoft-onedrive
- Alternatives: https://whats-best.ai/software/cloud-storage/microsoft-onedrive/alternatives ([markdown](https://whats-best.ai/software/cloud-storage/microsoft-onedrive/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-01 · oldest source captured 2026-11-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Microsoft Corporation
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan: Yes, per the vendor’s own page [S14]

## The panel's verdict

OneDrive for Business is Microsoft's cloud storage and file sharing service inside Microsoft 365 plans. Its strongest score is administration and governance, holding at 7 on Purview retention policies, eDiscovery holds, records with proof of disposition for up to seven years and data loss prevention conditions. Sharing and collaboration and encryption and security follow at 6-7, the first on administrator-enforced Anyone-link expiry, view-only restriction and domain lists of up to 5,000 entries, the second on AES 256 per-file keys exclusive to a single tenant, TLS in transit and a FIPS 140-2 Level 2 validated process. Pricing transparency is weakest at 2-3: storage per plan is published — 1 TB per user, 2 GB on F3 — but no monetary price appears on the captured pages. Sovereignty scores 4-5, since EU and EFTA residency requires an EU or EFTA sign-up, is forfeited when Multi-Geo is purchased, and limited transfers outside the boundary continue. Sync and access spans 4-6, the widest spread, with no public information on a Linux client, open protocols or file size limits.

**Speaks for it:**
- Administration and governance scores hold at 7 on Purview retention policies, eDiscovery holds, records with proof of disposition for up to seven years and data loss prevention conditions
- Sharing controls are administrator-enforced, with forced expiry on Anyone links, view-only restriction, allow and block domain lists of up to 5,000 domains and automatic guest access expiry
- Encryption is documented in depth — AES 256 at rest with per-file keys exclusive to a single tenant, TLS in transit, a FIPS 140-2 Level 2 validated process and an optional Customer Key in Azure Key Vault
- The Microsoft Graph API is documented with SDKs, webhooks, a delta synchronization API, a file picker SDK and PowerShell automation
- Windows and Mac sync apps with Files On-Demand and Known Folder Move, plus iOS and Android apps, are documented, alongside a 93-day recycle bin and restore to any point over the past 30 days

**Held against it:**
- No monetary price for any plan appears on the captured pages, so an annual cost cannot be computed from what is public
- EU and EFTA residency requires an EU or EFTA sign-up, is forfeited when Multi-Geo is purchased, and limited transfers outside the boundary continue
- We found no public information on a Linux client, open protocols such as WebDAV, SFTP or S3, block-level sync or file size limits
- We found no public information on bulk export with folder structure and versions, migration tools from a named provider, or a self-hosted edition
- We found no public information on end-to-end encryption, an independent audit, or ISO 27001, SOC 2 or BSI C5 certification on the captured pages

**Best for:**
- You already run Microsoft 365 and need retention policies, eDiscovery holds and records with proof of disposition for up to seven years to show an auditor
- You share files with outside clients and partners and want administrator-enforced link expiry, view-only Anyone links and domain allow and block lists of up to 5,000 domains
- Your developers build inside the Microsoft stack and want a documented REST API with SDKs, webhooks and a delta synchronization API
- Your staff work on Windows and Mac machines with iOS and Android phones, and Files On-Demand and Known Folder Move fit that footprint

**Avoid if:**
- You need to compute an annual cost from public prices before committing — ask the vendor: the public pages we read do not show it
- You require unconditional European residency — the EU Data Boundary applies only with an EU or EFTA sign-up, is forfeited when Multi-Geo is purchased, and admits limited transfers outside the boundary
- You need shared departmental or organizational storage — OneDrive is provisioned per user, and storing departmental and organizational level data, including system backups, is not supported
- Your toolchain depends on a Linux client or drive-letter access — the documented sync clients cover Windows, Mac, iOS and Android

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The Data Protection Officer | The Architecture Practice Partner | The Tax Adviser | The Agency Producer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Sync, clients & file access | 2.5/5 | 3/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2/5 |
| Sharing & external collaboration | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 |
| Encryption, key custody & recovery | 3.5/5 | 3/5 | 3/5 | 3/5 | 3.5/5 | 3.5/5 |
| Administration, audit & governance | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Export, API & self-hosting | 3/5 | 2.5/5 | 3/5 | 2.5/5 | 3/5 | 2.5/5 |
| European sovereignty | 2.5/5 | 2/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 |
| Pricing transparency | 1.5/5 | 1/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 |
| **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** | **2.5/5** |

### The judges

- **The IT Lead** (v1.0): Runs IT with one colleague for a 180-person machine builder with three sites and a sales office in Poland. Is retiring the old file server and wants every account provisioned from Entra ID, team folders that stay with the company when someone leaves, an audit log they can hand to the auditor, a lost laptop wiped remotely, and a way back to the last clean state if ransomware ever encrypts a share.
- **The Data Protection Officer** (v1.0): External data protection officer for a hospital group, two care providers and a payroll bureau, where the files are patient letters and salary statements. Reads who holds the keys before the feature page, asks whether end-to-end encryption survives a share link and the office editor, and wants the subprocessor list, the storage location and the contracting entity in writing before a single folder moves.
- **The Architecture Practice Partner** (v1.0): Partner in a 25-person architecture practice in Hamburg whose CAD and BIM models run to several gigabytes each, worked on from the office, from home and on the building site. Needs files on demand so laptops do not fill up, sync that sends only what changed, a drive letter the CAD software accepts, phones that open plans offline in a basement, and structural engineers who can pick up a folder without an account.
- **The Tax Adviser** (v1.0): Runs a tax practice with eleven staff and 400 clients, bound by professional secrecy under §203 StGB. Receives receipts, payslips and annual accounts from clients who will not install anything, and sends back drafts that must not end up in a forwarded email. Needs upload links, shares with expiry and passwords, a record of who downloaded what, and a provider that cannot read the files it stores.
- **The Agency Producer** (v1.0): Producer at a 30-person video and design agency in Cologne that sends cuts, layouts and raw footage to customers every day and collects their feedback. Wants review links that play in the browser, comments on the file, transfers of 100 GB that do not stall, freelancers added for one project and removed after it, connections to Slack and the project tool, and a storage bill that does not jump when one shoot fills a terabyte.
- **The Skeptic** (v1.0): Has seen "end-to-end encrypted" on a service that switches it off for shared folders, "hosted in Germany" on storage whose accounts and support run from the US, and "lifetime" plans from a company two years old. Reads that a product is "GDPR-compliant" and asks who holds the keys, whether ten years of folders, versions and shares can be exported in a form another provider imports — and what leaving would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- DPA addendum to product terms: The DPA is an addendum to the Product Terms site (formerly OST) [S10]
- DPA definition: Data processing and security terms for Microsoft Products are defined in the Microsoft Online Services Data Protection Addendum (DPA) [S10]
- DPA download availability: Current and archived editions of the DPA are available for download [S10]
- DPA latest version: 2026-11 · English [S10]
- Ediscovery premium requirement: Italy · New Zealand · Spain · Sweden · eDiscovery premium features [S7]
- Encryption security: OneDrive data protected with advanced encryption, compliance, and security features [S8]
- Log pseudonymization: yes [S9]
- Pseudonymization techniques: 0 · 1 · 2 · 3 [S9]
- Reidentification controls: yes [S9]
- Sharepoint fips140 2 level2: SharePoint encryption process · FIPS 140-2 Level 2 [S5]
- Teams fips algorithms: yes [S5]
- Tls https: SSL/TLS HTTPS · yes [S11]

**Hosting**
- Available geographies: APC · AUS · AUT · BRA · CAN · CHL · DNK · EUR · FRA · DEU · IND · IDN · ISR · ITA · JPN · KOR · MYS · MEX · NZL · NOR · POL · QAT · ZAF · ESP · SWE · CHE · TWN · ARE · GBR · NAM [S7]
- Countries: EU · EFTA [S9]
- Datacenter countries: Austria · Belgium · Denmark · Finland · France · Germany · Greece · Ireland · Italy · Netherlands · Norway · Poland · Spain · Sweden · Switzerland [S9]
- Efta countries: Liechtenstein · Iceland · Norway · Switzerland [S9]
- EU data boundary exclusion: no [S7]
- US government azure storage: Office 365 U.S. Government customers · yes [S5]

**Integrations**
- Access level enum: View · read-only link · Edit · read-write link [S11]
- Alternative formats: Download files in alternative formats such as PDF [S8]
- API versions: in-development features, not for production · stable production code · v1.0 · beta [S11]
- Auth method: Bearer OAuth 2.0 access token · 401 [S11]
- Bicep templates: Bicep templates available [S14]
- Change notifications event hubs: Change Notifications integration with Azure Event Hubs (example solution) [S14]
- Change notifications webhooks: Webhooks for file change notifications and a delta API for synchronization [S8]
- Code samples: single-page app · web app · web API · desktop app · mobile app · background service/daemon/script [S12]
- Code samples: Sample gallery of code samples [S14]
- Correlation header: X-CorrelationId · uniquely identifies request for troubleshooting [S11]
- Excel API: Excel API allows working directly with raw data in Excel workbooks [S8]
- File handler extensions: File handler extensions allow apps to add custom file extensions with icons/previews, New button entries, and custom menu bar actions [S8]
- File picker sdk: File picker SDK for opening, downloading, saving, sharing OneDrive files from within third-party apps [S8]
- Fromurl method: FromUrl · get site collection and site IDs for an absolute site URL [S11]
- Get link endpoint: GET · Microsoft.OneNote.Api.GetAnonymousSharingLink [S11]
- Get or create endpoint: POST · Microsoft.OneNote.Api.GetOrCreateAnonymousSharingLink [S11]
- Msal: Microsoft Authentication Library (MSAL) [S12]
- Msal languages: yes [S12]
- Notes API: Notes API provides access to OneNote notebook contents [S8]
- Permission scopes: Notes.ReadWrite · Notes.ReadWrite.All [S11]
- Powershell sharing domain: Set-SPOTenant · -SharingDomainRestrictionMode · -SharingAllowedDomainList · -SharingBlockedDomainList [S4]
- Revoke endpoint: DELETE · Microsoft.OneNote.Api.RevokeAnonymousSharingLink [S11]
- Revoke success code: 204 [S11]
- Sdks: SDKs available for Microsoft Graph [S14]
- Service root urls: OneDrive for Business · SharePoint site notebooks · Unified group notebooks [S11]
- Services scope reference: EU Data Boundary Services are identified in the Microsoft Product Terms [S9]
- Success code: 200 [S11]
- Toolkit fluid framework: Graph Toolkit integration with Fluid Framework (example solution) [S14]

**Pricing**
- Csp minimum: 5 [S7]
- Developer program subscription: Microsoft 365 Developer Program may include a free renewable developer subscription [S14]
- Eligible base plans: Microsoft 365 F1 · Microsoft 365 F3 · Microsoft 365 E3 · Microsoft 365 E5 · Microsoft 365 E7 · Office 365 F3 · Office 365 E1 · Office 365 E3 · Office 365 E5 · Exchange Online Plan 1 · Exchange Online Plan 2 · OneDrive Plan 1 · OneDrive Pla… [S7]
- Minimum license percentage: 5 [S7]
- Purchase channels: Enterprise Agreement · Web Direct · CSP [S7]
- Shared resources no license: no [S7]
- Small business education ineligible: no · no [S7]
- Storage limits: 1024 · 5 · 1024 · 5 · 2 · 1024 · 1024 · 1024 [S2]
- User level addon: user-level add-on · yes [S7]

**Product**
- Access requests:  [S3]
- Adaptive protection retention: preview · yes · 120 [S6]
- Adaptive scope advantages: yes · yes [S6]
- Adaptive scope limitations: no · Skype for Business · Exchange public folders [S6]
- Admin access control: yes [S1]
- Admin center: OneDrive managed via SharePoint admin center [S1]
- Admin notifications: yes [S1]
- Admin retention default: yes · 30 [S1]
- Admin sharing settings: yes [S1]
- Admin storage limit: yes [S1]
- Admin sync settings: yes [S1]
- Anonymous links capabilities: yes · yes · yes · edit · view · yes [S11]
- Anyone link expiration: yes [S4]
- Anyone link permissions: restrict Anyone links to view-only permission [S4]
- Anyone links restriction option:  [S3]
- Anyone sharing option: yes · no [S4]
- API reference versions: OneDrive file storage API reference available in Microsoft Graph v1.0 and beta versions [S8]
- API surface: OneNote · Outlook REST API v2.0 · Outlook REST API beta · Outlook REST API v1.0 · Discovery Service APIs · Video APIs · Office 365 API endpoints for China [S15]
- Architecture: Primary Provisioned Geography plus Satellite Geography locations; geography, group and user information mastered in Microsoft Entra ID [S7]
- Attestation and audit: Apps certified through detailed attestation and security audits [S13]
- Audit capabilities: yes · yes · yes · no [S6]
- Automation tool: App Compliance Automation Tool for Microsoft 365 accelerates certification journey [S13]
- Azure regional services: Azure regional services deployed in an EU Data Boundary region are in-scope [S9]
- Azure resource manager configuration: Azure Resource Manager set to EU Data Boundary [S9]
- B2b guest account: yes [S3]
- Compliance report pages: In-program apps receive dedicated compliance and data handling report pages [S13]
- Conditional access: Conditional Access [S12]
- Configuration time: within a month after receipt of licenses [S7]
- Content metadata API: REST APIs expose extracted metadata from photo, audio, and video files without downloading binaries [S8]
- Content search label condition: yes [S6]
- Customer data definition: All data provided to Microsoft through use of the Online Service; excludes Professional Services Data and configuration information [S9]
- Definition: Geographically defined boundary for storing and processing Customer Data and personal data for Azure, Dynamics 365, Power Platform, and Microsoft 365 [S9]
- Deprecated status: Office 365 REST API documentation is archived for reference only · no [S15]
- Description: Identity management for employees and partners [S12]
- Disposition review: yes · no [S6]
- Dlp condition: yes [S6]
- Domain limit count: 5000 [S4]
- Domain restriction: allow/block domain lists, max 5000 domains [S4]
- Drive storage model: Files stored in drives: personal OneDrive drives or shared drives powered by SharePoint document libraries [S8]
- Dynamics geo determination: billing address [S9]
- Dynamics power platform configuration: tenant and all environments in EU/EFTA Macro Region Geography · billing address in EU Data Boundary country [S9]
- Ediscovery hold protection: yes [S6]
- Education storage limit note: yes [S2]
- Entra b2b models: SharePoint external authentication · Microsoft Entra B2B integration [S4]
- Entrant b2b settings apply: yes [S3]
- Exchange bitlocker: all mailbox data · yes [S5]
- Exchange customer key: yes [S5]
- Exchange customer key admin separation: yes [S5]
- Exchange service encryption: yes [S5]
- Existing guests option: yes [S4]
- External auth no guest account: no [S3]
- External collaboration b2b: Microsoft Entra B2B [S2]
- External sharing default on: yes [S3]
- External sharing purpose: Share content with people outside the organization and between licensed users on multiple Microsoft 365 subscriptions [S3]
- Feature availability: Storage · Sync features · Sharing and collaboration features · Web features · Mobile features · IT admin, security, and compliance features [S2]
- File requests requirement: File Requests · OneDrive set to Anyone with edit permissions for Anyone links [S4]
- Files API overview: OneDrive is the files hub in Microsoft 365, accessible via a single Microsoft Graph API across Teams, groups, and SharePoint [S8]
- Files on demand: yes · view and interact with cloud files in File Explorer without downloading them; supports Always keep on this device and Free up space [S1]
- Files restore: yes · 30 [S1]
- Flex routing unavailable: no [S7]
- Fromurl indexing requirement: may take several hours · yes [S11]
- Governance: access-lifecycle management and policy enforcement [S12]
- Graph auth: yes · yes [S15]
- Graph platforms: .NET · PHP · Java · Python · Ruby on Rails · UWP · iOS · Android [S15]
- Graph replacement: OneNote · Outlook · Excel · OneDrive · Microsoft Teams · Planner · SharePoint · Microsoft Graph [S15]
- Graph toolkit: Microsoft Graph Toolkit with login, people picker, and person card controls [S14]
- Group connected site sharing: x [S3]
- Group type support: unified [S11]
- Guest access expiration: admin-set automatic guest access expiration in days [S4]
- Guest access reinstate: yes [S4]
- Guest invitation email: email with link to shared item [S3]
- Guest license limits: x [S3]
- Guest license requirement: yes [S3]
- Guest office web only: yes · no [S3]
- Guest revoke timeframe: within one hour [S4]
- Guest share items not owned: guests need full control permission to share externally [S4]
- Guest visibility of names: yes [S3]
- Identity protection: real-time identity risk detection and remediation [S12]
- Internal only option: yes · no [S4]
- Key store farm key bitlocker: Farm key · SharePoint secret store [S5]

**Support**
- Community channels: Stack Overflow · Microsoft Q&A [S12]
- Developer support: yes [S12]
- Graph explorer: Graph Explorer to try the API in browser without code [S14]
- Message center: Message Center [S2]
- Microsoft support: yes [S1]
- Tech community: yes [S1]

89 more facts on the canonical page: https://whats-best.ai/software/cloud-storage/microsoft-onedrive

## Questions

### Is Microsoft OneDrive for Business European?

No. whats-best.ai classifies Microsoft OneDrive for Business as Rest of world.

### Where does Microsoft OneDrive for Business store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

### Does Microsoft OneDrive for Business have a free plan?

Yes. Microsoft OneDrive for Business has a free plan, per [the vendor’s page captured 1 Nov 2026](https://whats-best.ai/evidence/13694).

### What are the best alternatives to Microsoft OneDrive for Business?

As of 1 Nov 2026, the panel rates [Nextcloud Files (Nextcloud Hub) (4/5)](https://whats-best.ai/software/cloud-storage/nextcloud-files), [Tresorit (3.5/5)](https://whats-best.ai/software/cloud-storage/tresorit) and [Proton Drive (3/5)](https://whats-best.ai/software/cloud-storage/proton-drive) highest among the other 13 Cloud Storage & File Sharing products evaluated. The highest-rated European alternative is [Nextcloud Files (Nextcloud Hub)](https://whats-best.ai/software/cloud-storage/nextcloud-files) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Microsoft OneDrive for Business alternatives](https://whats-best.ai/software/cloud-storage/microsoft-onedrive/alternatives).

## Head-to-head

- [Microsoft OneDrive for Business vs Nextcloud Files (Nextcloud Hub)](https://whats-best.ai/compare/microsoft-onedrive-vs-nextcloud-files.md)

## What this page leaves out

- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Product documentation (overview): https://learn.microsoft.com/en-us/sharepoint/onedrive-overview (checked 2026-11-01)
- [S2] Service description (features and plans): https://learn.microsoft.com/en-us/office365/servicedescriptions/onedrive-for-business-service-description (checked 2026-11-01)
- [S3] Product documentation (external sharing): https://learn.microsoft.com/en-us/sharepoint/external-sharing-overview (checked 2026-11-01)
- [S4] Product documentation (sharing settings): https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off (checked 2026-11-01)
- [S5] Security documentation (encryption): https://learn.microsoft.com/en-us/compliance/assurance/assurance-encryption-for-microsoft-365-services (checked 2026-11-01)
- [S6] Product documentation (retention): https://learn.microsoft.com/en-us/purview/retention (checked 2026-11-01)
- [S7] Product documentation (Multi-Geo data residency): https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-multi-geo?view=o365-worldwide (checked 2026-11-01)
- [S8] API documentation: https://learn.microsoft.com/en-us/graph/onedrive-concept-overview (checked 2026-11-01)
- [S9] EU Data Boundary documentation: https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-learn (checked 2026-11-01)
- [S10] Data protection addendum: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA (checked 2026-11-01)
- [S11] Sharing & external collaboration — found from sitemap: https://learn.microsoft.com/en-us/previous-versions/office/office-365-api/how-to/onenote-sharing-links (checked 2026-11-01)
- [S12] Administration, audit & governance — found from sitemap: https://developer.microsoft.com/en-us/identity/entra-id (checked 2026-11-01)
- [S13] Administration, audit & governance — found from sitemap: https://developer.microsoft.com/en-us/microsoft-365/app-compliance-program (checked 2026-11-01)
- [S14] Export, API & self-hosting — found from sitemap: https://developer.microsoft.com/en-us/graph/rest-api (checked 2026-11-01)
- [S15] Export, API & self-hosting — found from sitemap: https://learn.microsoft.com/en-us/previous-versions/office/office-365-api/ (checked 2026-11-01)
- [S16] Legal notice: https://www.microsoft.com/de-de/rechtliche-hinweise/impressum (checked 2026-11-01)

---

Cite as: whats-best.ai, "Microsoft OneDrive for Business — Cloud Storage & File Sharing", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/cloud-storage/microsoft-onedrive

Corrections: https://whats-best.ai/correct/1223?target=page