Does Microsoft Scan Your OneDrive Files? The Answer Is More Nuanced Than You Think

The short answer

Yes, Microsoft processes your OneDrive files to power AI features. No, they do not read your personal files for advertising. The reality sits in the space between those two statements, and understanding that space is what matters for your privacy decisions.

What Microsoft actually does with your files

Microsoft's privacy policy for OneDrive describes several categories of data processing that go beyond simple storage:

• AI-powered search and discovery: OneDrive's Discover feature analyzes your files to surface relevant content. This is content processing, not just indexing.
• Microsoft Copilot in OneDrive: The Copilot integration reads and processes file content to answer questions and generate summaries. This is documented AI processing of your files.
• Content indexing: Microsoft indexes your files for search functionality. This is standard practice across all cloud storage providers and is not uniquely invasive.
• Spam and malware scanning: Microsoft scans uploaded files for security threats. This is standard, automated, and not a privacy concern in the traditional sense.

What Microsoft does not do

• Sell your file data: Microsoft does not sell your OneDrive content to advertisers or third parties.
• Serve targeted ads from file content: OneDrive does not use your file content to serve advertising.
• Share file content with government on demand: Without a valid legal process, Microsoft will not provide file content to authorities. With a legal process, they can and will.

The Copilot question

Microsoft Copilot in OneDrive is the feature that generates the most concern, and the concern is legitimate. When Copilot is enabled, it reads your file content to generate responses. This is not background indexing — it is active processing of your documents, spreadsheets, and files.

The key setting to check is in your Microsoft 365 privacy dashboard. You can limit how Copilot uses your data. However, Microsoft's enterprise agreements and US legal obligations mean that data processed through Copilot may still be subject to government access requests under US law.

The encryption reality

OneDrive uses Microsoft-managed encryption keys, not zero-knowledge encryption. This means Microsoft can technically access your file content. They have policies against doing so without legal justification, and their enterprise agreements include data processing commitments. But the architectural capability exists.

For comparison, fii.one uses zero-knowledge encryption where only you hold the keys. Microsoft cannot access your file content, even technically, because they never receive the decryption capability. This is an architectural difference, not just a policy difference.

How to limit Microsoft's file processing

• Go to your Microsoft privacy dashboard and disable Copilot data processing
• Turn off OneDrive Discover if you do not use it
• Use Microsoft 365 admin controls to manage AI feature access for your organization
• Consider moving highly sensitive files to a zero-knowledge provider if Microsoft's data processing is a concern

Compare: fii.one vs OneDrive.

What OneDrive scanning means for your privacy

When people ask whether Microsoft "scans" OneDrive, they usually picture an employee reading their documents. In practice, the scanning that happens is almost entirely automated. Microsoft runs uploaded files through malware detection, and it uses hash-matching to detect known child sexual abuse material (CSAM), a legal requirement that most major cloud providers follow. These systems compare files against databases rather than a person opening and reading your content.

On top of that, Microsoft indexes file contents so features like search and, increasingly, Copilot AI can surface and summarise your documents. This indexing is automated too, but it does mean the content of your files is processed by Microsoft's systems rather than staying sealed. Human review is limited and typically triggered only by specific events, such as an abuse report, a legal request, or a flagged security incident, and it is governed by Microsoft's policies and applicable law.

The key takeaway: your OneDrive files are not private from Microsoft in a technical sense. Because Microsoft controls the encryption keys, its systems can access your content when needed. That is normal for mainstream cloud storage, but it is a meaningful distinction if you store sensitive or confidential material. To understand why, it helps to know how zero-knowledge encryption differs from standard provider-managed encryption.

How to keep sensitive files private on (or off) OneDrive

You cannot fully disable Microsoft's automated scanning while keeping files in OneDrive, because malware and CSAM detection are built into the service. But you can reduce exposure with a few practical steps: move highly sensitive files into OneDrive Personal Vault for an extra identity-verification layer, encrypt files yourself before uploading (for example with a local tool or an encrypted archive), limit sharing links and permissions, and keep your most confidential data on a provider that cannot read it at all.

If privacy is the priority, the most reliable option is storing sensitive data with a zero-knowledge provider where the files are encrypted before they leave your device and only you hold the keys. A service like fii.one is designed so that no automated system, and no employee, can read your content, which sidesteps the scanning question entirely.

Consumer OneDrive vs OneDrive for Business: what scanning actually differs

Most articles answer "does Microsoft scan OneDrive" as if there is one OneDrive. There are two, and the privacy implications are different. If you are on a personal Microsoft account, Microsoft controls the scanning. If you are on a work or school tenant, your organization's admins control it — and they often see more than Microsoft's baseline.

The practical takeaway: on a work OneDrive, assume your IT department can inspect, export, and retain anything you store — DLP policies routinely scan document contents for sensitive strings, and eDiscovery lets legal teams pull your files without notifying you. That is not Microsoft snooping; it is your employer using tools Microsoft provides. Never store genuinely personal documents in a business tenant.

On a consumer account, the scanning is narrower — malware, CSAM, and AI indexing — but you still cannot switch off the core scans, and Microsoft's ability to decrypt (it holds the keys) means the content is never provably private. If the file is sensitive enough that scanning matters, the reliable fix is the same in both cases: encrypt it yourself before it ever reaches OneDrive, or keep it in a provider that cannot read it. For finding those files again once they are spread across encrypted stores and multiple accounts, a dedicated file hosting search engine beats OneDrive's own indexing, which only sees what Microsoft is already scanning.

Frequently asked questions