Microsoft 365 Ransomware and Mass Deletion Playbook

When thousands of files in OneDrive or SharePoint are encrypted, overwritten or deleted at once, the recovery tools you choose and the order you use them in decide whether you restore in hours or lose data for good. Mass changes usually come from one of three sources: ransomware on a device syncing files to the cloud, a compromised account or app working through the Microsoft Graph API, or an insider or mistaken bulk action. This playbook covers how the incident shows up, triage questions, containment, and the customer-side restore options in order: OneDrive restore, document library restore, version history, the recycle bins, retention and the Preservation Hold library, Microsoft 365 Backup and the Microsoft Support window. It is written for Microsoft 365 administrators, SharePoint owners and incident responders. Object storage ransomware in services such as Amazon S3 and Azure Blob is covered in the Cloud Ransomware Guide; this page is specific to Microsoft 365 content.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

Stop the sync before you restore. Microsoft's first step for SharePoint ransomware is to stop OneDrive sync or disconnect mapped drives, otherwise an infected device keeps writing encrypted files over your restores.
Know your windows. OneDrive restore and library restore reach back 30 days, the recycle bins hold deleted items for 93 days, and Microsoft can recover SharePoint content for 14 more days through a support request.
Version history is bounded by settings. Libraries keep a configurable number of versions, and versions trimmed by library limits are permanently deleted rather than sent to the recycle bin.
Microsoft 365 Backup changes the scale. Where it is set up, it restores whole sites and OneDrive accounts to 10 minute points for the last 14 days and weekly points up to 52 weeks.
Find the identity behind the change. A user's device, a compromised account or an over-permissioned app each need different containment, and the unified audit log shows which one it was.

How the incident shows up

Signal	Where to see it	What it suggests
Most files in a library share the same Modified By and timestamp	Library view, version history	Bulk overwrite by one identity (Microsoft lists this as a ransomware sign)
Files renamed with an appended extension; files that will not open	Users, library view	Encryption by a syncing device (ATT&CK T1486)
New files named like ransom instructions in many folders	Library view	Ransom note distribution
Large spike in `FileDeleted`, `FileModified` or `FileRenamed` audit events	Microsoft Purview unified audit log	Mass deletion or encryption (T1485, T1486)
OneDrive ransomware detection notice to a user	User email or OneDrive web	OneDrive has suggested a restore date
Mass deletion or ransomware activity alerts	Microsoft Defender for Cloud Apps or Microsoft Defender XDR	Anomalous file activity by a user or app
Recycle bin items purged, version limits or retention changed	Audit log, SharePoint admin centre	Recovery sabotage (T1490)

The identity behind the activity is usually a cloud account (T1078.004) acting directly, a device that holds a synced copy of the library, or an app granted Sites.ReadWrite.All or Files.ReadWrite.All through OAuth consent. See the Microsoft 365 Unified Audit Log Guide for Detection for the search patterns.

Triage questions

Which identity made the changes? Search the unified audit log for the affected site or OneDrive and group file events by user, app ID, client IP and user agent. The OneDrive sync client, a browser and a Graph API app look different.
When did it start? Find the earliest modification by the suspect identity. Every restore option asks for a point in time before this.
How wide is it? List every site, library and OneDrive the identity could write to. A user who syncs many team sites can encrypt all of them from one device.
Was it encryption, overwrite or deletion? Encrypted in place files recover through versions; deleted files recover from the recycle bin; renamed and re-uploaded files may need both.
Were recovery settings changed? Check for changed version limits, purged second-stage recycle bins, removed retention policies or offboarded Microsoft 365 Backup policies.
Was data copied out? Look for FileDownloaded and FileSyncDownloadedFull spikes and sharing link creation before the encryption.
Which tools do we hold? Confirm whether Microsoft 365 Backup is set up, which retention policies cover the sites, and whether a third-party backup exists.

Containment priorities

Stop the writer. If a device is the source, isolate it with your EDR and have the user stop OneDrive sync; Microsoft's SharePoint guidance says to stop sync or disconnect mapped drives immediately. If an account is the source, block sign-in and revoke its sessions in Microsoft Entra ID. If an app is the source, disable the enterprise application or remove its consent.
Protect the recovery points. Make sure no one purges recycle bins during the incident and do not lower version limits. If retention policies or a Microsoft 365 Backup policy were removed, restore them from a trusted admin account now.
Restrict privileged roles. Review who holds SharePoint Administrator, Global Administrator and Microsoft 365 Backup administration rights, and remove any additions made during the incident. See Microsoft 365 admin centres and admin roles.
Tell affected users not to fix it themselves. Users restoring individual versions while a bulk restore runs can create conflicts and new versions that complicate the timeline.
Escalate if the tenant itself is in doubt. New admin accounts, changed conditional access or federation settings point to a tenant compromise; run the Microsoft 365 Tenant Compromise Playbook alongside this one.

Eradication

Clean or reimage the source device before it signs in again, and remove it from the user's trusted devices. The wider device response is in the Ransomware Response and Recovery Guide.
Reset the account properly: reset the password, require reregistration of MFA methods if they may be attacker controlled, revoke refresh tokens, and review mailbox rules and app consents granted by the user. See the Account Takeover Response Playbook.
Remove app access: delete or reduce permissions on any app registration or enterprise app that performed the bulk changes, and rotate its secrets and certificates. Prefer Sites.Selected over tenant-wide file permissions for apps that need SharePoint access.
Remove sharing links created by the suspect identity during the window.

Recovery

Pick the narrowest tool that covers the damage. The table lists the customer-side options Microsoft documents and their windows as stated on its pages.

Option	Scope	Window	Use when
Restore your OneDrive	One OneDrive, whole account to a point in time	Last 30 days	One user's OneDrive was encrypted or mass deleted
Restore a document library	One SharePoint or Teams library	Last 30 days	Damage is limited to one or a few libraries
Version history	Individual files	As many versions as the library limits keep	A handful of files encrypted in place
Recycle bin	Deleted files and folders	93 days	Originals were deleted after encrypted copies were written
Preservation Hold library	Versions retained by retention settings	The retention policy's period	Retention covers the site and versions were trimmed
Microsoft 365 Backup	Whole sites and OneDrive accounts, in place or to a new URL	10 minute points for 14 days, then weekly points to 52 weeks	Many sites or accounts, or damage older than 30 days
Microsoft Support restore request	Site collections	14 days beyond actual deletion	Content cannot be restored by any other route

OneDrive

Work or school users open Settings, then Restore OneDrive, choose a preset or custom date, and use the activity chart and feed to select the first unwanted change; every later change is selected too. Files created after the restore point move to the recycle bin rather than disappearing, and a restore can itself be undone by running Restore again. If automatic ransomware detection triggered the restore, OneDrive suggests the date. Administrators can perform the same restore on a user's behalf after taking access to that user's OneDrive.

SharePoint and Teams libraries

Library owners use Restore this library from the library settings to roll the library back to a point within 30 days. For many sites, Microsoft 365 Backup is the scalable route: it restores whole sites to a prior point, fastest in place to the same URL and from a restore point the tool marks as faster. Microsoft states that Backup content is immutable unless an administrator offboards the product. Detail on configuring it is in the Microsoft 365 Backup guide.

Exchange Online and Teams

Mass deletion sometimes reaches mailboxes too. Microsoft documents single item recovery and mailbox retention for rolling back deleted messages, with a default window of 14 days that can be configured up to 30 days, and retention policies for longer periods. Microsoft 365 Backup also restores whole mailboxes or individual items found by search. Teams files live in SharePoint and OneDrive and chats in Exchange mailboxes, so they recover through those same routes rather than through a separate Teams tool.

Choosing by organisation size

Small tenants with a few users and sites can usually recover with OneDrive restore, library restore and the recycle bin, provided they act inside 30 days; the critical step is noticing quickly. Larger tenants face the limits of per-library tools: restoring hundreds of libraries one at a time is slow and error-prone, and damage discovered after 30 days falls outside those tools. For them, a site-level backup that restores many protection units in parallel, plus alerting that catches mass changes within the hour, is what keeps recovery time predictable. The SaaS Backup Buyer's Guide sets out neutral criteria if you are evaluating options.

Sequencing a large restore

Confirm the writer is stopped and the start time is known.
Restore the highest-value sites and OneDrive accounts first, agreed with business owners.
Restore in place where the content has no legal hold reason to keep the damaged state; otherwise restore to a new URL and keep the original for evidence.
Check a sample of restored files opens correctly before telling users the site is back.
Recover deleted items from the recycle bins that fall outside the restored scope.
If any content remains unrecoverable inside the 14 day support window, open a Microsoft Support request with the site URLs and the last known good time, as Microsoft's guidance requires.

Metric	What good looks like
Time from first alert to stopped writer	Under one hour
Share of critical sites covered by Microsoft 365 Backup or equivalent	All sites rated critical
Libraries with version limits below the organisation default	Zero without a recorded exception
Restore test completed for a site and a OneDrive this quarter	Yes, with timing recorded
Mass deletion alerts routed to the SOC	All, with an owner

Evidence to preserve

Evidence	Why it matters	How to keep it
Unified audit log export for affected sites and identities	Who did what, from where, and when it started	Export searches for the window plus prior days; audit retention depends on licence and policy
Microsoft Entra ID sign-in and audit logs	Account takeover path, app consent	Export or stream to your SIEM before retention expires
Defender alerts and device timeline	Process that encrypted synced files	Export the incident and the device timeline
Sample encrypted files and ransom notes	Family identification	Download copies to an isolated evidence store
Site and library settings before restore	Version limits, retention and sharing state	Screenshot or export configuration
Damaged state of key libraries	Legal or insurance needs	Restore to a new URL instead of in place, or keep a copy

Playbook phase	NIST CSF 2.0	NIST SP 800-53 Rev 5	MITRE ATT&CK v20 addressed
Triage	RS.AN-03, DE.CM-03	IR-4, AU-6	T1078.004 Cloud Accounts, T1213.002 Sharepoint
Containment	RS.MI-01	AC-2, IA-5	T1528 Steal Application Access Token
Recovery	RC.RP-01, RC.RP-03	CP-9, CP-10	T1485 Data Destruction, T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery
Preparedness	PR.DS-11	CP-9	Not applicable
Notification	RS.CO-02	IR-6	Not applicable

Notification triggers

Personal data: loss of availability through encryption or deletion, as well as theft, is a personal data breach under GDPR and UK GDPR. Article 33 requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours unless it is unlikely to result in a risk to individuals; Article 34 adds notice to individuals when the risk is high. A complete restore within hours and no evidence of download may support a low-risk assessment, but record the reasoning. See the Breach Notification Laws by Country Guide.
Regulated sectors: NIS2, DORA and sector rules have their own clocks; see the Cyber Incident Reporting Requirements Map.
US listed companies: Form 8-K Item 1.05 for material incidents, generally within four business days of the materiality determination.
Insiders: if an employee deliberately deleted content, involve HR and legal before contacting them; see the Insider Sabotage Response Playbook.

Practitioner checklist

Set up Microsoft 365 Backup or an equivalent for critical SharePoint sites and OneDrive accounts, and test a restore each quarter.
Keep organisation version limits at or above Microsoft's recommended setting, and alert on library-level reductions.
Apply retention policies to key sites so versions are copied to the Preservation Hold library.
Alert on mass deletion, mass modification and ransomware activity for users and apps.
Limit apps to Sites.Selected where possible and review tenant-wide file permissions.
Write down who can run OneDrive restore, library restore and Backup restores, and rehearse each.
Keep the Microsoft Support escalation details and the 14 day window in the playbook.
Reduce the number of team sites each user syncs to what they need.

Microsoft 365 Ransomware and Mass Deletion Playbook: Restore SharePoint and OneDrive Content at Scale