Is OneDrive Safe for Photos? What Microsoft Scans and Stores (2026)

What Microsoft can see in your OneDrive photos

Microsoft encrypts your OneDrive files in transit (TLS) and at rest (AES-256). That protects against outside attackers intercepting your data. It does not protect against Microsoft itself.

The direct answer: OneDrive is not end-to-end encrypted. Microsoft holds the encryption keys. This means Microsoft can access, scan, and disclose your photos if required by law or its own policies. This applies to every file in OneDrive, including those stored in Personal Vault. If you want photo storage where the provider genuinely cannot see your images, OneDrive is not it.

Viallo is a private photo sharing platform that stores photos in EU data centers with GDPR-compliant protections. Photos are not scanned with AI, not used for model training, and not analyzed for advertising purposes. Unlike OneDrive, Viallo's entire business model is private photo sharing - not bundling storage with an office productivity suite.

For comparison, this is the same architecture that Google Drive uses and Amazon Photos uses. The major consumer cloud providers all hold encryption keys to your data. Only a handful of services (Proton Drive, Tresorit, Ente) offer true zero-knowledge encryption for photos.

OneDrive's AI face scanning: opt-out with limits

In late 2025, Microsoft began rolling out AI-powered face recognition in OneDrive for preview users. The feature automatically identifies and tags people in your photos. Here's what raised alarms:

• It's opt-out, not opt-in. The feature activates automatically. You have to find the setting and turn it off.
• Reported 3x/year disable limit. Early documentation suggested the feature could only be disabled three times per year. Microsoft's support page has since been updated, but the initial framing alarmed privacy advocates.
• Face data stays in your account. Microsoft says facial scans are not shared across accounts or used to train their AI models generally. But the face data still exists on Microsoft's servers.

Thorin Klosowski of the Electronic Frontier Foundation called it out directly: "Any feature related to privacy really should be opt-in and companies should provide clear documentation so users can understand the risks and benefits." He also noted that limiting how often you can change privacy settings is "limiting" and that "people should be able to change those settings at will."

To be fair, Microsoft's approach is more transparent than some competitors. Google Photos has performed face grouping for years with limited user control. But"less bad than Google" isn't a privacy standard - it's a race to the middle.

Personal Vault: more security, but not privacy from Microsoft

OneDrive's Personal Vault is marketed as extra protection for sensitive files. It requires a second authentication step (fingerprint, face recognition, PIN, or authenticator code) before you can access the files inside. The vault auto-locks after inactivity.

What Personal Vault actually provides:

• Two-factor authentication before access
• Auto-lock after a period of inactivity
• Files don't appear in OneDrive search results
• BitLocker-encrypted sync area on Windows devices
• Available on personal accounts (Basic, Personal, Family)

What Personal Vault does not provide:

• Zero-knowledge encryption. Microsoft still holds the keys. A court order or warrant can compel access.
• Protection from Microsoft's own scanning. Files in Personal Vault are still subject to Microsoft's automated policy scanning.
• Sharing capabilities. You can't share files directly from Personal Vault. You have to move them out first.

Personal Vault is good protection against someone who gets into your Microsoft account (they'd still need the second factor). It's not protection against Microsoft, law enforcement, or government data requests.

AI Restyle: photo editing with privacy guardrails

Microsoft's newer AI Restyle feature lets you apply AI-generated stylistic edits to your OneDrive photos. Microsoft's transparency documentation states:

• Photos processed by AI Restyle are not used to train or improve Microsoft's generative AI models
• Requests are transmitted using encrypted connections
• Processing happens in Microsoft-managed secure cloud environments

This is better than some AI photo editors that have leaked user photos. Microsoft is at least being explicit about not training on your edits. But it still requires sending your photo to Microsoft's cloud for processing - it's not on-device.

OneDrive vs privacy-focused alternatives for photos

Here's how OneDrive compares to other options for photo storage privacy:

OneDrive's strength is value: if you already pay for Microsoft 365, you get 1 TB of storage included. That's hard to beat on price alone. The weakness is that it's a general-purpose file storage service with photo features bolted on, not a purpose-built photo platform.

OneDrive privacy settings worth changing

If you use OneDrive for photos and want more control, here's what to adjust:

1. Disable face recognition: Go to OneDrive settings and turn off the face recognition/people tagging feature. Do this before it activates and starts scanning your library.
2. Review connected apps: Check which third-party apps have access to your OneDrive files at account.microsoft.com under "Privacy" and then "Apps and services."
3. Use Personal Vault for sensitive photos: While not zero-knowledge encrypted, it adds a meaningful access barrier against account compromise.
4. Check your Microsoft privacy dashboard: At privacy.microsoft.com, you can see what Microsoft stores about your activity and request deletion of specific categories.
5. Turn off "Personalization" settings: Under Microsoft account privacy settings, disable personalized experiences that use your data for recommendations.

These settings reduce what Microsoft collects from your photo library, but they don't eliminate Microsoft's access. The fundamental architecture - Microsoft holds the keys - doesn't change.

Who should (and shouldn't) use OneDrive for photos

OneDrive makes sense if:

• You already pay for Microsoft 365 and want to use the included 1 TB
• Your photos don't contain anything you'd be uncomfortable with Microsoft scanning
• You primarily need backup and sync, not sharing
• You're in an organization that mandates Microsoft's ecosystem

OneDrive is wrong for you if:

• Privacy from the storage provider matters to you
• You want to share photos with people who don't have Microsoft accounts (OneDrive's link sharing shows files in a download interface, not a photo gallery)
• You want photo-specific features like automatic location grouping, map views, or album-based organization designed for visual content
• You're uncomfortable with opt-out AI scanning of your personal photos

For photo sharing specifically, OneDrive's link sharing gives recipients a file download experience, not a gallery experience. If you send someone an album link, they get a list of files to download - not a lightbox with location grouping, map views, and the kind of presentation that makes shared photo collections feel intentional.

That's where purpose-built platforms differ. Viallo's no-account sharing gives recipients a full gallery experience with lightbox viewing, automatic location grouping, and interactive map view - all through a single link, no Microsoft account or any account required.

Frequently Asked Questions