Is OneDrive encrypted?
No. Microsoft holds the keys to the files you keep in OneDrive, so it can read them. Personal Vault adds an extra sign-in step, not a key only you hold.
Checked on 25 October 2026 against 7 sources.
Made by Secria, which is building Secria Workspace. We grade every app by the same rules. How we check
- Your photos and filesMicrosoft can read itEach file is encrypted with its own key, and Microsoft keeps the master keys that protect those keys.1, 5
- Shared links and albumsMicrosoft can read itShared files and links are stored the same way.1
- Post-quantumNot yetNo post-quantum protection for stored files announced as of 25 October 2026; Microsoft says it aims to move its products to it by 2029.7
- Personal VaultMicrosoft can read itIt adds an extra sign-in step and locks itself when you stop using it, but Microsoft says it is just a place in OneDrive with an extra layer of security, and never calls it end-to-end encrypted.2, 1
- Who holds the keys
- Microsoft holds the keys to your files, including the ones in Personal Vault.
- What Microsoft can still see
- Your files and photos themselves, which Microsoft indexes so you can search them and, where face grouping is on, sorts by the faces in them.
On business plans, admins with Microsoft 365 E5 can add Double Key Encryption to labelled files, so Microsoft can't open them.
Email is worth checking next: Gmail, Outlook and iCloud Mail can all read your mailbox. See which email services can.
Can Microsoft see my OneDrive files?
Yes. Microsoft says each file is encrypted at rest with its own key, and those keys are locked with master keys that Microsoft stores1. Its privacy statement says it collects the content you store, and indexes your OneDrive documents so you can search them later3.
Microsoft also scans documents for known malware when they're downloaded1. It says its engineers have no standing access to the service, and must ask for time-limited access when they need it1.
On some business plans, admins can add Double Key Encryption, which Microsoft says its online services can't open6.
Is OneDrive Personal Vault end-to-end encrypted?
No. Personal Vault is a part of OneDrive that asks for a strong sign-in method or a second check each time you open it, and locks again after 20 minutes without use on the web, or 3 minutes on a phone2. On a Windows 10 PC, its files sit in an encrypted area of the drive2.
That helps if someone gets into your account or your device. It doesn't keep Microsoft out: Microsoft calls Personal Vault "just a place in OneDrive with an extra layer of security", and doesn't describe it as end-to-end encrypted2, 1. Without a paid plan, it holds up to three files2.
Does OneDrive group my photos by face?
It can. Microsoft's help page says OneDrive groups faces into a People section, and that the feature is rolling out gradually4. You can turn it off in OneDrive's settings, and Microsoft says it then deletes the face data within 30 days4. Some regions need your consent first4.
How OneDrive compares
Sorted by how many parts are sealed by default, then by how many can be. Ties go A to Z.
Sources
- How OneDrive safeguards your data in the cloud (Microsoft Support), Microsoft. Read on 25 Oct 2026.
- Protect your OneDrive files in Personal Vault (Microsoft Support), Microsoft. Read on 25 Oct 2026.
- Microsoft Privacy Statement (updated September 2026), Microsoft. Read on 25 Oct 2026.
- Group photos by people in OneDrive Photos (Microsoft Support), Microsoft. Read on 25 Oct 2026.
- Encryption in Microsoft 365 (Microsoft Learn), Microsoft. Read on 25 Oct 2026.
- Double Key Encryption (DKE) (Microsoft Learn), Microsoft. Read on 25 Oct 2026.
- Accelerating the quantum-safe timeline (Microsoft Security Blog, 30 June 2026), Microsoft. Read on 25 Oct 2026.
Changes to this answer
- First published.