How to restore files from a cloud backup in Microsoft 365 after accidental deletion or ransomware

Summary

This guide helps you troubleshoot and resolve: How to restore files from a cloud backup in Microsoft 365 after accidental deletion or ransomware. Follow the steps below to fix the issue.

Common Causes

Accidentally deleting a file or falling victim to ransomware can be stressful, but Microsoft 365 includes several built-in recovery features that can help you restore your data quickly. This guide walks you through recovering files using the Recycle Bin, version history, and the OneDrive for Business restore function. Follow the steps that best match your situation.

Quick Fix: Check the Recycle Bin First

For recently deleted files, the Recycle Bin is the fastest place to look. Files remain here for 93 days by default before being permanently removed.

Restore from the SharePoint Recycle Bin

1. Open your browser and sign in to https://www.office.com.
2. Click the app launcher (the nine-dot grid) in the top-left corner and select SharePoint.
3. Navigate to the site containing the deleted file.
4. Click Site contents in the left-hand navigation pane.
5. Click Recycle Bin in the top-right corner of the Site Contents page.
6. Locate the file you need, tick the checkbox next to it, and click Restore.

Restore from the OneDrive Recycle Bin

1. Sign in to https://onedrive.com using your work account.
2. Click Recycle bin in the left-hand navigation pane.
3. Select the files you want to recover.
4. Click Restore at the top of the page.

Restore Previous Versions of a File

If a file has been modified or overwritten (for example, by ransomware encrypting the contents), version history lets you roll back to an earlier, clean copy.

Restore a Version in OneDrive for Business

1. Sign in to https://onedrive.com.
2. Right-click the affected file and select Version history.
3. Review the list of available versions, including the date, time, and the person who saved each version.
4. Hover over the version you want and click the three dots, then choose Restore.
5. Confirm the restore when prompted. A new copy will be created and the previous version will become the current version.

Restore a Version in SharePoint

1. Navigate to the document library containing the file.
2. Right-click the file and select Version history.
3. Click the dropdown arrow next to the version you wish to restore.
4. Select Restore.

Restore an Entire OneDrive Account After Ransomware

If a large number of files have been encrypted or deleted, restoring your entire OneDrive to a previous point in time is often the most efficient option. Microsoft retains snapshots of your OneDrive for up to 30 days, depending on your plan.

1. Sign in to https://onedrive.com.
2. Click Settings (the gear icon) in the top-right corner.
3. Select Options from the dropdown menu.
4. Click Restore your OneDrive in the left-hand menu.
5. Choose a date from the dropdown calendar. Select a date from before the ransomware attack or accidental deletion occurred.
6. Tick the boxes next to the file types you want to restore, or select Select all.
7. Click Restore to begin the recovery process.

Restore Files in Microsoft Teams

Files shared within Teams are stored in the associated SharePoint site or OneDrive, so the recovery steps above also apply. To locate a file shared in a Teams chat or channel:

1. Open Microsoft Teams.
2. Navigate to the chat or channel containing the file.
3. Click the Files tab at the top of the conversation.
4. Click Open in SharePoint or Open in OneDrive at the top of the Files tab.
5. Follow the SharePoint or OneDrive version history steps outlined above.

Recovering Files Deleted by a Former Employee

If files were deleted by someone who has since left your organisation, an administrator can access their OneDrive and restore the data within 30 days of the account being deleted.

1. Sign in to the Microsoft 365 Admin Centre at https://admin.microsoft.com.
2. Go to Users > Deleted users.
3. Select the deleted user account and click Restore.
4. Once restored, sign in to that user's OneDrive to access and recover any required files.

When Built-In Recovery Is Not Enough

If the Recycle Bin has been emptied, version history is unavailable, or the 30-day restore window has passed, you may need to investigate additional backup solutions. For comprehensive protection against ransomware and accidental deletion, consider implementing a third-party cloud-to-cloud backup service that retains data independently of Microsoft 365.

For guidance on backing up local files such as photos and documents to an external drive, see our guide on How to backup photos to external drive.

Troubleshooting

The Recycle Bin appears empty

• Confirm you are signed in with the correct work or school account, not a personal Microsoft account.
• Check whether a retention policy has been applied that purges files sooner than 93 days.
• Ask a SharePoint administrator to check the second-stage Recycle Bin at https://<yourtenant>-admin.sharepoint.com/_layouts/15/online/AdminRecycleBin.aspx.

Version history is greyed out or missing

• Version history may be disabled at the document library level. Contact your SharePoint administrator to enable it under Library Settings > Versioning settings.
• Some file types, such as legacy Microsoft Office formats, may have limited version support. Re-save the file in the modern .docx, .xlsx, or .pptx format.

The OneDrive restore option is not visible

• This feature is only available in OneDrive for Business, not personal OneDrive accounts.
• Your licence may not include this capability. Speak with your Microsoft 365 administrator or partner to confirm your plan includes OneDrive for Business Plan 2 or equivalent.

Files restored but content is still encrypted

• Ensure you selected a restore date from before the ransomware infection occurred.
• Disconnect the affected device from your network immediately to prevent re-infection.
• Change passwords for all affected accounts and enable multi-factor authentication.
• Open a ticket with our team so we can assist with containment and recovery planning.

If you have exhausted these recovery options, please contact our support team for further assistance. We can help assess whether a third-party backup solution may be required and advise on next steps for securing your environment.

Still Having Issues?