OneDrive and Office 365 maintain a “zero-standing access” Microsoft onedrive security policy, which means that engineers do not have access to the service unless it is explicitly granted in response to a specific incident that requires elevation of access.
To do this, OneDrive and Office 365 maintain strict separation between “elevation roles,” with each role only allowing certain predefined actions to be taken. Taken together, these investments in access control greatly reduce the likelihood that an engineer in OneDrive or Office 365 inappropriately accessed customer data.