Recovering deleted OneDrive files after the recycle bin window

The ticket arrives with the phrase "it was there in the spring". OneDrive's built-in recovery is generous for 93 days and then stops abruptly, and most admins only learn where the edges are while a user is waiting. Here is what exists on the far side of that window, in the order you should check it.

First, confirm the window really has passed

OneDrive's recycle bin is 93 days total — the first-stage bin the user sees, plus the second-stage bin the site collection administrator sees, sharing the same clock from the moment of deletion. Users routinely say "months ago" about a file deleted eight weeks ago.

Check both stages before going further:

1. As the user: OneDrive → Recycle bin.
2. As admin: the user's OneDrive URL with /_layouts/15/AdminRecycleBin.aspx appended, or via SharePoint admin center → user profile → OneDrive → Manage recycle bin. You need site collection admin on the OneDrive, which the SharePoint admin center grants in two clicks.

If the file is in either bin, restore it and stop reading. If the second-stage bin is full, older items get purged early to make room — the 93 days is a maximum, not a promise.

Case 1: the user has left

This is the most common "after retention" case, and it is usually recoverable. When a user is deleted, their OneDrive is kept for the period set in SharePoint admin center → Settings → OneDrive → Retention. The default is 30 days; it can be set up to ten years. During that period:

• The OneDrive is accessible to the user's manager (if the manager attribute was populated) and to admins.
• The whole OneDrive can be restored by restoring the user from Entra ID's deleted users, which brings the OneDrive back attached to the account.

After the retention period the OneDrive site is deleted and lands in the SharePoint tenant recycle bin, where deleted sites sit for a further 93 days. From there you can restore it with Restore-SPODeletedSite -Identity and the OneDrive URL, and the restored OneDrive can be handed to a manager or a successor. Once it leaves the tenant recycle bin, it is gone.

So for a departed user the real window is retention period plus tenant recycle bin, which is much longer than the 93 days most people assume. Check Get-SPODeletedSite -IncludeOnlyPersonalSite before declaring anything lost.

Case 2: Files Restore

Files Restore (OneDrive → Settings → Restore your OneDrive) rolls the entire OneDrive back to any point in the last 30 days, undoing deletes, edits and moves in one operation. It is the right tool for "a sync client or a script deleted everything on Tuesday", and the wrong tool for "I want one file from June" — it is 30 days, full stop, and it rolls back everything else too.

Use it when the damage is broad and recent. It is also what Microsoft's ransomware detection in OneDrive points users toward.

Case 3: a retention policy or hold covered the OneDrive

If a Purview retention policy applied to OneDrive accounts when the file was deleted, the file was copied into the Preservation Hold library of the OneDrive rather than truly deleted, and it stays there for the retention period. This library is invisible to the user and to normal browsing, but:

• Admins with site collection admin rights can open it at the OneDrive URL plus /PreservationHoldLibrary.
• The content is searchable in eDiscovery and can be exported.

Retention policies do not care about the recycle bin clock. A OneDrive under a seven-year retention policy has every deleted file for seven years, regardless of what the recycle bin shows. This is the only built-in mechanism that reaches past 93 days for a live user, and it only helps if the policy was in place before the deletion. Check the Purview compliance portal → Data lifecycle management → Retention policies to see what covers OneDrive, then look in the hold library.

Case 4: backup

Microsoft 365 Backup (the first-party service, billed by storage) or a third-party backup product can restore files from any snapshot the product took. Microsoft 365 Backup keeps restore points for a defined period and restores at the OneDrive or folder level; third-party products vary. If you have either, this is a straightforward restore and the answer to "how far back?" is whatever the product's retention says. See the Microsoft 365 backup deep dive for what each layer can rehydrate.

If you have neither, you cannot retroactively buy your way out. Backup captures from the day you enable it.

Case 5: Microsoft support

There is a narrow, support-only path: for a site that has been permanently deleted from the tenant recycle bin, Microsoft support may be able to restore it for a short period afterwards — documentation has historically said within 14 days of the permanent deletion. This is for whole OneDrive or SharePoint sites, not individual files, and it is best-effort. It is worth a ticket if a whole OneDrive fell out of the tenant recycle bin last week. It is not worth a ticket for one file deleted in March; support will tell you there is nothing to restore, and they will be right.

Places people forget to look

• Version history on the file's parent, if the "deleted" file was actually overwritten or replaced rather than removed.
• The sync client's local copy. If the user's PC still has the file in OneDrive - Contoso and has been offline, do not sign in — copy the file out first.
• Copies in Teams chats, email attachments, or other people's OneDrives. A file shared with three people usually exists in a Sent Items folder somewhere.
• Windows Backup / Known Folder Move on a device that was in use before OneDrive was set up — a stale local Documents folder is sometimes still there.

The lesson

The 93-day recycle bin is not a data protection strategy; it is a convenience. If OneDrive holds data that matters past three months, put a retention policy on OneDrive accounts (it costs nothing beyond the licence you already have), set the deleted-user retention to at least a year, and decide deliberately whether you need backup. Do that now, while there is not a user waiting.