OneDrive sync is the feature that keeps cloud-stored files available on a local Windows device by copying them into a synced folder and updating them automatically. It is designed for convenience and offline access, so the same document can exist both in Microsoft 365 and on the endpoint.
In cyber security, this matters because endpoint malware can steal local copies of cloud files without breaking into the cloud service itself. A stealer running on an infected laptop may collect documents, metadata, and other workspace content that were synced from OneDrive or SharePoint. This makes the device a bridge to cloud data. Defenders can reduce risk by limiting sync on sensitive or unmanaged devices, protecting endpoints against infostealers, and monitoring for unusual file access alongside credential and token theft.