The first step in the recovery plan, following Microsoft Security Best Practices, would be:

Disable Microsoft OneDrive sync and Exchange ActiveSync.

This step isolates the affected devices by stopping synchronization with Microsoft services (like OneDrive and Exchange) to prevent further spread of the ransomware or data encryption across other systems. Once the environment is isolated, further investigation and recovery actions can be taken.