Microsoft OneDrive
OneDrive stores files online and keeps them in sync between your Mac and other devices. It’s made by Microsoft, based in the United States.
Criminals have used its name in fake downloads or scams, so get it only from microsoft.com.
What it is
People use OneDrive to store documents and photos, share files and work on Microsoft 365 documents together. Files appear in Finder. Files On-Demand lets you keep files online until you need them, saving space on your Mac.
OneDrive reads and uploads the files you sync. Its optional folder backup also uploads your Desktop and Documents folders. That feature needs the version downloaded from Microsoft and Full Disk Access permission.
Microsoft distributes the app through its website and the Mac App Store. Microsoft says files are encrypted in OneDrive and remain private unless you share them. If you stop folder backup, files already uploaded stay in the OneDrive folder until you move them back.
Who makes it
Microsoft is a technology company founded in 1975 and based in Redmond, Washington. Its legal name is Microsoft Corporation. Its website is microsoft.com.
Microsoft makes other software with flaws that attackers have used. Its page in Companies lists them.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of Microsoft OneDrive. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is com.microsoft.OneDrive or com.microsoft.OneDrive-mac. Download it only from microsoft.com or the Mac App Store, not from an ad or a link someone sends you.
Fakes. In July 2024, Trellix reported fake OneDrive pages that claimed a connection problem and told people to run a malicious PowerShell command as a repair. The reported attack targeted Windows users.
What it connects to
In normal use, Microsoft OneDrive talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
onedrive.live.com | Personal OneDrive service |
*.onedrive.com | OneDrive services |
login.live.com | Personal account sign-in |
*.sharepoint.com | Work and school file syncing |
login.microsoftonline.com | Work and school account sign-in |
oneclient.sfx.ms | Updates, features and bug fixes |
g.live.com | Updates, features and bug fixes |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Full Disk Access | Required for the optional backup of Desktop and Documents folders. |
Security record
Problems with Microsoft OneDrive or Microsoft in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| Microsoft disclosed a Mac OneDrive flaw that let an attacker with local access gain higher privileges; version 26.095.0519.0003 fixed it. | ↗ | |
| Positive Technologies found a Mac OneDrive flaw that let a local user gain full system privileges; its report said Microsoft confirmed it and planned a fix, but named no fixed version. | ↗ | |
| Microsoft reported that attackers who stole corporate emails also accessed source code and internal systems; it added security controls and reported no evidence of compromise of customer-facing hosted systems. | ↗ |
References
- Why do I have two versions of OneDrive on my Mac? support.microsoft.com
- Facts About Microsoft news.microsoft.com
- OneDrive — Mac App Store apps.apple.com
- Back up your folders with OneDrive support.microsoft.com
- Download the OneDrive app microsoft.com
- The OneDrive sync app update process learn.microsoft.com
- OneDrive Sync release notes learn.microsoft.com
- Required URLs and ports for OneDrive learn.microsoft.com
- Microsoft 365 URLs and IP address ranges learn.microsoft.com
- OneDrive Pastejacking: The crafty phishing and downloader campaign trellix.com
- Microsoft security record for CVE-2026-65680 raw.githubusercontent.com
- CVE-2026-65680 — Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability msrc.microsoft.com
- PT-2025-21: Local Privilege Escalation in Microsoft OneDrive global.ptsecurity.com
- Update on Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard microsoft.com