DMARCGuardian Practical help for DMARC, SPF, DKIM, and BIMI.

Blog · Deliverability

How to Detect OneDrive Sync Failures Before Data Loss Accumulates

By DMARCGuardian Editorial Team ·

A user opens a support ticket. Their most recent CSV exports from the past five days are gone. OneDrive shows a green checkmark. SharePoint shows files from five days ago. Nothing in the recycle bin. The sync client had stopped silently, and no one caught it until the user happened to notice.

This is not a rare edge case. It is a predictable failure mode that Microsoft documents, forums discuss regularly, and most M365 administrators encounter at least once without warning.

Why OneDrive Sync Clients Stop Silently

OneDrive uses the Files On-Demand model. The sync client talks to SharePoint Online, compares local and cloud file states, and updates accordingly. When that connection breaks, the sync client does not always surface a visible error. It may display a green checkmark while local files accumulate as unsynced copies.

Known failure triggers include:

  • Credential expiry. A user's password changes. They do not re-authenticate OneDrive. The client continues showing a green icon while syncing nothing.
  • Windows Update. An update replaces or resets the OneDrive client without notification. The service restarts but the sync state is corrupted or paused.
  • VPN changes. The network path to SharePoint Online endpoints changes. The client cannot reach the service but does not register this as an error state.
  • Group Policy conflicts. Policy changes disable the sync client or alter its behavior mid-session.
  • Storage quota exceeded. Either the SharePoint site storage quota or the user's local drive fills up. The sync client pauses without a prominent alert.
  • SharePoint site locks. A site is placed in read-only or locked mode during maintenance. The sync client fails to upload changes and does not surface this clearly.

The pattern across these triggers is the same: the sync client stops working, the user continues editing local files, and no one knows until a problem surfaces.

Detecting Sync Failures Across Your Tenant

OneDrive Admin Center Sync Reports

The OneDrive admin center shows per-user sync status. Navigate to a user's OneDrive and check the sync activity section. A user who was actively syncing but shows no activity for several days is worth investigating. The limitation is that this requires checking users individually, which does not scale for large tenants.

PowerShell Checks

The SharePoint Online Management Shell provides cmdlets that can surface sync status at scale. The key metric to query is the LastSyncTime on each user's OneDrive. If you have a list of active users, you can script a comparison against expected activity and flag outliers.

For most tenants, the most practical approach is to generate a weekly report of users whose last sync time is older than a threshold you define based on your organization's working patterns.

Microsoft Purview Sync Health Reports

If your organization has E5 or A5 licensing, Purview compliance center includes sync health reports that aggregate OneDrive sync status across the tenant. These reports flag devices that have not synced within a configurable window and can be exported for IT follow-up. This is the most scalable option for organizations with hundreds of users.

The threshold for alerting should account for weekends, holidays, and remote workers who may go longer between sync events legitimately.

What to Do When You Discover a Failed Sync Client

When you find a user whose sync client stopped, do not immediately restart the client. Follow this sequence:

1. Assess. Ask the user whether they created or modified files locally during the gap. If they only edited files that live inside SharePoint-synced folders and those files were already uploaded before the client stopped, the risk is low.

2. Recover from OneDrive version history. SharePoint keeps version history for synced files. You can restore a previous version directly from the file in the browser. This is the fastest recovery path.

3. Recover from Microsoft Purview eDiscovery. For files that were never uploaded (local-only files), Purview eDiscovery may be able to recover content from compliance backups. This requires an active eDiscovery case, appropriate licensing, and time. It is not instantaneous. If the user had files open when the client stopped and those files never synced, this is your next option.

4. Re-sync carefully. Once you have confirmed recovery, restart the OneDrive client. Make sure the user does not close any open files during the re-sync process. Watch for the client attempting to upload files that are newer locally and potentially overwriting older cloud versions.

Local-only files that were never uploaded to SharePoint cannot be recovered from SharePoint. This is the scenario with the most severe data loss risk, and it is the scenario that proactive monitoring is designed to prevent.

Preventing Silent Sync Failures at Scale

Automated Monitoring with Power Automate or Logic Apps

Power Automate can use the Microsoft Graph API to poll OneDrive sync status on a schedule. When a user's last sync time exceeds your threshold, the flow sends an alert to your IT ticketing system. A practical threshold is 24 hours for daily workers, 48 hours for part-time or flexible schedules.

This does require the account running the flow to have appropriate Graph API permissions to read OneDrive sync status across the tenant.

Intune Proactive Remediation

For organizations managing devices through Intune, you can deploy proactive remediation scripts that check whether the OneDrive client service is running and, if not, attempt to restart it. This catches client-level failures that may not appear in the admin center for some time.

M365 Alert Policies

You can configure alert policies in the M365 compliance center to notify admins when there is a gap in SharePoint or OneDrive activity for a specific user. Set the condition to trigger when there is no activity for more than a defined number of days. This requires E5 or A5 licensing.

Always Keep a Copy Locally

For high-risk users who frequently work offline or on planes, configure the "always keep a copy locally" setting in the OneDrive admin center. This stores a full copy of files on the local device regardless of the Files On-Demand setting. It consumes local storage but eliminates the local-only file risk.

End-User Guidance Template

Tell users this:

  • Check the OneDrive icon in your taskbar every morning. Blue arrows mean syncing. A green checkmark means everything is synced. Any red or yellow icon means something needs attention.
  • If you see a red or yellow icon, do not keep working and assume it will fix itself. Open the OneDrive activity center and check what is blocked.
  • If you are working on files that matter, save a copy to a second location. A local folder on your desktop is not a backup.
  • If your computer behaves unexpectedly after an update or a VPN change, check whether OneDrive is still syncing before you start a long work session.

The goal is to make checking sync status as routine as checking email.

The Monitoring Principle Behind This

Silent failures are the most expensive failures because they accumulate damage before anyone knows something is wrong. The same principle that makes email authentication monitoring valuable - catching failures before they cause incidents - applies directly to OneDrive sync health. Tools like DMARCFlow that monitor email authentication continuously and alert on silent failures embody the same monitoring mindset that catches OneDrive sync gaps: you cannot fix what you cannot see.

Without proactive monitoring, you find out about a sync failure when a user notices and opens a ticket. By then, the data loss window may already be closed.

FAQ

How do I know if OneDrive synced successfully?
Check the sync status icon in the taskbar. A green checkmark means synced. Blue arrows mean actively syncing. Any warning icon means the client needs attention. In the OneDrive admin center, you can see the last sync timestamp per user. If that timestamp looks stale for an active user, investigate.

Can I recover files edited while sync was stopped?
Possibly. If the files were synced to SharePoint before the client stopped, you can restore them via OneDrive version history in the browser. If the files were local-only and never uploaded, Purview eDiscovery may be able to recover them from compliance backups, but this is not guaranteed and takes time. Local-only files that never reached SharePoint cannot be recovered from the cloud.

How do I get alerted automatically if a user's sync client stops?
Three practical options depending on your license level: Power Automate or Logic Apps using the Microsoft Graph API to poll last sync time and alert when a threshold is exceeded; Microsoft Purview sync health reports (E5/A5) for tenant-wide visibility; or Intune proactive remediation to check and restart the OneDrive client service on managed devices.

Does restarting the OneDrive client overwrite my files?
Not automatically. The OneDrive sync client is designed to reconcile local and cloud changes rather than blindly overwrite either direction. However, if you have been editing a file locally and the cloud version is older, you may be prompted to choose which version to keep. Review any conflict dialogs carefully before dismissing them.