Office 365 OneDrive rollback after ransomware

Overview

OneDrive versioning helps with file encryptors if caught early—coordinate with security before mass restores.

Steps

1. Identify infection window via Defender incidents file timeline.
2. Use admin restore for known-good versions or backup vendor point restore.
3. Revoke refresh tokens for compromised accounts; reset passwords.

Caveats

Version history limits vs retention; synced deletes—act within hours.

Comms

Executive summary: files touched count, restore % complete, ongoing monitoring.

Posture

Enable Known Folder Move + backup vendor for faster bulk restores next time.