Yes — OneDrive is encrypted, but it is not zero-knowledge or end-to-end encrypted. Files are protected in transit with TLS and at rest with BitLocker plus a unique AES-256 key per file. Microsoft generates and holds those keys as part of the service, so Microsoft can technically access file contents — for product features, automated content scanning, and in response to legal requests. Turning on Personal Vault does not change that: it adds a second authentication step and an auto-lock, not a different encryption model. This page covers what OneDrive actually encrypts, what Personal Vault does and does not add, whether AI features touch your files, and what a zero-knowledge alternative changes.
What OneDrive encrypts
Microsoft's own documentation describes two layers of at-rest encryption. Files are encrypted individually — a unique key per file, re-encrypted whenever the file changes — and the file content, the per-file keys, and the key store itself are kept in separate systems. On top of that, the underlying disks are BitLocker-encrypted. Microsoft states the cipher as AES-256, FIPS 140-2 validated. In transit, connections use TLS.
That is a real, standard encryption design, and it protects against the threats server-side encryption is built for: a stolen disk, an intercepted connection, a breach of the storage layer itself. It does not protect your files from Microsoft, because Microsoft holds every key in that chain. There is no step in it where only you hold a key.
Can Microsoft read your files?
Yes, it is able to. Holding the keys means Microsoft can decrypt file content, and several ordinary parts of the service depend on that ability:
- Automated content scanning. Like every major consumer storage provider, Microsoft runs automated scanning for known child-exploitation material (hash-matching against known imagery) across its consumer services, and separately scans uploads for malware.
- Product features. Search, thumbnails, previews, and the "Discover" feed all require reading file content.
- Legal requests. Microsoft's Trust Center states it does not give governments direct, unfettered access to customer data and says it challenges requests it can lawfully challenge — but that is a policy commitment about how Microsoft chooses to respond, not a technical inability to decrypt. When compelled, it can comply, because it holds usable keys.
This is the line between encrypted and zero-knowledge. Encrypted keeps outside attackers out. Zero-knowledge keeps the provider out too, because encryption happens on your device before upload and the provider never holds a key that opens it. OneDrive is encrypted; it is not zero-knowledge.
Personal Vault doesn't change the answer
Personal Vault is the OneDrive feature most likely to be confused with end-to-end encryption, so it's worth being precise about what it actually is. Enabling it adds a second authentication step to a specific folder — a PIN, biometric unlock, or a code from an authenticator app or SMS — plus an idle auto-relock and a block on sharing files stored inside it. On a Windows PC, the locally synced copy of Personal Vault files sits inside a BitLocker-encrypted area of the disk, which is a genuine local protection even on a machine that doesn't otherwise use BitLocker.
What Personal Vault does not add is a separate cloud-side encryption scheme. Files inside the vault get the same per-file AES-256 and BitLocker-at-rest protection as every other OneDrive file, with Microsoft still holding the keys. The vault raises the bar for who can open the app and browse to the file — a stronger authentication gate — not who can decrypt the file on Microsoft's servers. That's a meaningfully different property from Apple's Advanced Data Protection, which does move iCloud into genuine end-to-end encryption for most data categories once turned on (see is iCloud encrypted). OneDrive has no equivalent switch: Personal Vault on or off, Microsoft's technical access to file content is unchanged.
Does Microsoft scan or train AI on your files?
This splits into two different products with two different answers, and the gap between them matters.
Microsoft 365 Copilot (tenant/business content). Microsoft's stated position is that organizational content accessed through Microsoft 365 Copilot — the files, mail, and chats Copilot can see via Microsoft Graph — is not used to train the underlying foundation models.
Consumer Copilot (personal accounts). This is the narrower, easily-missed distinction: Microsoft's own Copilot privacy documentation states that data from consumer Copilot, Bing, and MSN — including images or files you upload in a consumer Copilot conversation — is used for AI training by default, unless you opt out. A file processed through consumer Copilot is a different case from a file simply sitting in OneDrive untouched, but the two are close enough in a normal workflow (open a file in Copilot to summarize it, say) that the distinction is easy to lose.
Separately from either training question, OneDrive's "Discover" surface and related Connected experiences features read and process file content at run time to do things like semantic search, summarization, and photo grouping — inference, not training, but still Microsoft's systems reading file content to generate a result. Some of this can be scoped down under Connected experiences in Microsoft 365 account privacy settings, though it isn't fully off by default. For the fuller comparison of "not used to train" versus "cannot read" across providers, including this same OneDrive consumer/business split, see can your cloud provider train AI on your files.
Neither of these requires bad faith on Microsoft's part — they're consequences of holding the keys. A provider that never has the key can't scan, process, or train on file content even if it wanted to; a provider that holds the key can choose not to, today, as a matter of policy.
Two 2025 disclosures worth knowing
A OneDrive File Picker permissions flaw (May 2025). Security researchers at Oasis Security disclosed that OneDrive's File Picker component — the widget many third-party web apps use to let a user select a OneDrive file — was requesting broad Files.Read.All or Files.ReadWrite.All OAuth scopes even for a single-file selection, rather than scoping access to just the file chosen. The practical effect, as reported by multiple outlets at the time, was that a range of third-party services using the picker could end up holding a grant to a user's entire OneDrive rather than the one file the user meant to share. This is a design/permissions flaw in how third-party access was scoped, not a break of OneDrive's file encryption itself — but it's a reminder that "who can technically reach your files" is broader than the encryption question alone.
A CLOUD Act admission (June 2025). At a French Senate hearing on 10 June 2025, Microsoft France's director of public and legal affairs, Anton Carniaux, was asked directly whether he could guarantee French citizens' data would never reach US authorities without French government consent. He answered: "No, I cannot guarantee that." As a US-incorporated company, Microsoft remains subject to the US CLOUD Act regardless of where a given data center physically sits — a jurisdictional exposure that exists independently of the encryption question, and one an on-record admission from the company's own counsel confirms directly rather than leaving to inference.
Is OneDrive safe for confidential files?
For most everyday use, OneDrive's encryption and Microsoft's infrastructure security are adequate — the design defends against the threats it's built for. The narrower question is whether "Microsoft can technically read this if it needs or is required to" is itself the risk for a specific file. For client records bound by professional confidentiality, medical data, legal case files, unreleased work, or source material, that property is exactly what you're trying to eliminate, and no amount of at-rest AES-256 changes it, because Microsoft holds the key regardless of Personal Vault, plan tier, or region.
What zero-knowledge changes
A zero-knowledge tool encrypts each file on your device before it ever reaches the provider's servers, so the provider stores only ciphertext it cannot decrypt, scan, process for AI features, or hand over in readable form — because it never holds a usable key. ShieldFive encrypts files on the device and stores ciphertext in the EU. The sign-in password never reaches its servers: the browser derives a separate login value with Argon2id and sends only that, and the vault key is derived separately on the device. The web app's code is served by ShieldFive, so the client delivered on each visit stays part of the trust boundary; this is not an absolute provider-cannot-decrypt guarantee. Web uploads default to ML-KEM-1024/XChaCha20-Poly1305 with AES-GCM fallback; Android also defaults to the hybrid format, with the same AES-GCM fallback, and reads both formats. The crypto core is open source, the apps are not fully open source, and no external security audit has been completed. Proton Drive, Tresorit, and Sync.com are zero-knowledge options with different tradeoffs on jurisdiction and audits. The best zero-knowledge cloud storage comparison weighs ten of them side by side, and the Google Drive alternative for confidential files guide covers moving off a mainstream provider in more detail — the same tradeoffs apply moving off OneDrive.
This page reflects Microsoft's public documentation as of 2026-08-31 and will be updated as the product changes.
Frequently asked questions
Is OneDrive encrypted?
Yes. OneDrive encrypts files in transit with TLS and at rest with BitLocker plus a unique AES-256 key per file, which Microsoft states is FIPS 140-2 validated. But it is not zero-knowledge or end-to-end encrypted: Microsoft generates and holds the keys, so the encryption protects files from outside attackers and stolen hardware, not from Microsoft itself.
Can Microsoft read my OneDrive files?
Yes, it is able to. Because Microsoft holds the encryption keys, it can access file content — for automated scanning (known child-exploitation imagery, malware), for product features like search and previews, and in response to legal requests it is compelled to honor. Microsoft's Trust Center describes policy commitments about challenging government requests, but that is a choice about how it responds, not a technical inability to decrypt.
Does Personal Vault make OneDrive end-to-end encrypted?
No. Personal Vault adds a second authentication step (PIN, biometric, or an authenticator code) and an auto-lock to a specific folder, and its locally synced copy sits in a BitLocker-encrypted area on Windows. It does not add a separate cloud-side encryption scheme — files inside the vault get the same per-file AES-256 encryption as any other OneDrive file, with Microsoft still holding the keys.
Does Microsoft use OneDrive files to train AI models?
It depends which Copilot. Microsoft states that organizational content accessed through Microsoft 365 Copilot is not used to train its foundation models. For consumer Copilot, Microsoft's own privacy documentation states that data — including images or files you upload — is used for AI training by default unless you opt out. Separately from either training question, Copilot's in-product features and OneDrive's "Discover" surface read and process file content at run time to generate results like search and summaries.
Is OneDrive HIPAA compliant?
OneDrive for Business and Microsoft 365 commercial tenants can support HIPAA with a signed Business Associate Agreement. Free and consumer OneDrive (Basic, Personal, Family plans) are not covered by Microsoft's enterprise Data Protection Addendum and don't carry the same compliance commitments — confirm current terms directly with Microsoft before relying on either tier for regulated data.
What is a zero-knowledge alternative to OneDrive?
Zero-knowledge providers encrypt files on your device before upload, so they never hold a key that could decrypt, scan, or process your content. ShieldFive encrypts files on the device and stores ciphertext in the EU. The sign-in password never reaches its servers: the browser derives a separate login value with Argon2id and sends only that, and the vault key is derived separately on the device. The web app's code is served by ShieldFive, so the client delivered on each visit stays part of the trust boundary; this is not an absolute provider-cannot-decrypt guarantee. Web uploads default to ML-KEM-1024/XChaCha20-Poly1305 with AES-GCM fallback; Android also defaults to the hybrid format, with the same AES-GCM fallback, and reads both formats. The crypto core is open source, the apps are not fully open source, and no external security audit has been completed. Which fits depends on jurisdiction, whether an external audit matters to you, and whether post-quantum protection is a requirement.