Recover deleted SharePoint and OneDrive data: options and limits

Work out what was deleted and when

Microsoft 365 has several overlapping safety nets, each with its own clock and its own scope. Picking the wrong one costs time, and in a couple of cases it can undo work your colleagues did after the deletion. So before you click anything, answer two questions: how much is missing, and roughly when did it go?

The recycle bin is not a backup, however much it behaves like one for three months. It is a holding area for deleted items, and it empties itself or gets emptied by someone. Treat the first hour as damage control: do not empty any recycle bin, stop any clean-up scripts or sync tidy-ups, and ask people not to re-upload copies of what they think is missing. Re-uploading matters because a point-in-time restore skips any file or folder that has been re-uploaded after deletion.

Use this list to choose a route, then jump to the matching section:

• A few files or folders deleted within the last 93 days: recycle bin.
• Many files deleted, overwritten or damaged within the last 30 days: Restore this library (SharePoint) or Restore your OneDrive.
• A whole site deleted within the last 93 days: Deleted sites in the SharePoint admin center.
• A departed employee's OneDrive: restore the user within 30 days, otherwise PowerShell for roughly the next 93 days.
• Past all of those windows: Microsoft Support backup restore (whole site collection only, 14 further days), or whatever retention or backup you set up beforehand.

Restore individual files and folders from the recycle bin

SharePoint and OneDrive keep deleted items in two stages. Deleting a file sends it to the site's recycle bin. Deleting it from there, or emptying that bin, sends it to the second-stage recycle bin (also called the site collection recycle bin). The 93 days run from the first deletion and cover both stages, so moving an item to the second stage does not restart the clock.

One catch for busy sites: the second-stage recycle bin is capped at 200% of the site collection quota, and when it overflows the oldest items are purged early. A large clear-out can therefore shorten the window for older deleted files.

Everything below is non-destructive and needs only the right level of access. For a OneDrive that is the owner of that OneDrive. For a SharePoint site, ordinary members can see the first-stage bin and a site collection administrator is needed for the second stage.

1. To recover from a person's own OneDrive, sign in as that person at the OneDrive website and select Recycle bin in the navigation pane. Tick the items and select Restore. Only the owner of a OneDrive can restore from its recycle bin through this route.
2. To recover from a SharePoint site, open the site and choose Recycle bin in the left-hand pane. On communication sites go to Site contents and then Recycle bin. Tick the items and select Restore.
3. If the items are not there, a site collection administrator should open the site's settings, choose Site settings and select Recycle bin under Site Collection Administration. Select the second-stage recycle bin link at the bottom of the page, tick the items and select Restore.
4. Open a couple of the restored files and confirm they are back in the folders you expect. Success looks like the files opening normally and appearing in the library again.

Undo a mass deletion or overwrite with a point-in-time restore

When hundreds of files have been deleted, overwritten or scrambled, the recycle bin is too slow and too coarse. Restore this library (SharePoint) and Restore your OneDrive rewind a library or a whole OneDrive to a chosen moment within the last 30 days.

This is the one route in this article that can quietly take good work away. A rollback undoes the selected activity and everything after it, including legitimate edits colleagues made once the damage had happened. Tell people before you press the button. It can be reversed by running Restore again and picking the restore action you want to undo, so it is a recoverable decision rather than a one-way door.

It relies on version history and the recycle bins, so it has hard limits. If versioning is off you cannot restore to a previous version. Anything already purged from the second-stage recycle bin cannot be brought back, and a deleted library cannot be restored this way. The tool is for the modern SharePoint experience only. Newly created document libraries default to 500 versions, and Microsoft warns that reducing versions weakens this restore, so it is worth leaving that setting alone.

Only a site admin can run Restore this library. For OneDrive, the option appears for the account you are signed in as, so a leaver's OneDrive needs the PowerShell route in the next section first.

1. For a SharePoint library, open the library and select Settings, then Restore this library. In Teams, go to the channel's Files tab, select More, then Open in SharePoint, and follow the same route. For a OneDrive, sign in to the OneDrive website and, on a work or school account, select Settings then Restore OneDrive.
2. Choose a restore point from the dropdown, such as Yesterday, or select Custom date and time. Use the daily activity chart and the activity feed to find the first unwanted action. If you are recovering from ransomware that OneDrive detected, a suggested date is filled in for you.
3. For a custom date, select the earliest activity you want to undo. Later activities are selected automatically. Warn anyone working in that library or OneDrive, then select Restore.
4. While the restore runs, anyone who opens the library sees a notice. Wait until it has gone before checking results, and leave the files alone until then.
5. Afterwards, confirm the files are back. Files created after the restore point are moved to the recycle bin rather than destroyed, and any items that failed are listed in a file named RestoreLog followed by an ID, which is also what Microsoft Support will ask for.

Restore a deleted site or library

Deleted SharePoint sites are kept for 93 days. After that the site and everything in it, including lists, libraries, pages and subsites, is permanently deleted. Restoring needs the SharePoint Administrator role or higher; Global Administrator is not required.

Group-connected sites carry one trap. Restoring the site restores its Microsoft 365 group and resources, but those other group resources are only retained for 30 days against the site's 93. If the site was deleted more than 30 days ago, check the group and what hangs off it before you tell anyone the job is finished.

A single deleted library is different. Restore this library will not bring one back; Microsoft points to the site's recycle bin for that.

1. Open Deleted sites in the SharePoint admin center and sign in with a SharePoint Administrator account.
2. Select the site you want to restore. If the Restore button is missing, you have more than one site ticked. Select just the one.
3. Select Restore, then open the site and check the content, ownership and, for a group-connected site, the group itself.
4. For a deleted library, open the parent site's recycle bin and look there, using the earlier section on recycle bins.

Recover a departed employee's OneDrive

Deleting a user from Microsoft Entra ID starts the OneDrive clean-up clock. Blocking sign-in or removing a licence does not. By default the OneDrive is retained for 30 days and the user's manager (or a secondary owner, if set) gets access and email warnings. After that it sits in a deleted state for a further 93 days, during which only a SharePoint Administrator can restore it, and only with PowerShell. Microsoft also notes that OneDrive accounts without a valid licence are archived on their 93rd unlicensed day, so do not leave a deleted user's data to the last week.

The PowerShell steps below need the SharePoint Online Management Shell on an admin workstation and a SharePoint Administrator account. Replace the YOUR_ placeholders with your own values. The check is read-only; the restore makes the OneDrive active again and it stays available until someone explicitly deletes it; granting access gives that admin account full control of someone's files, so do it with proper sign-off from whoever is entitled to approve access to that person's data.

1. If the user was deleted within the last 30 days, restore them from the Deleted users page in the Microsoft 365 admin center. That brings back the user and all their data and you can stop here.
2. Otherwise, open the SharePoint Online Management Shell and connect as a SharePoint Administrator. Replace YOUR_TENANT with the name of your tenant.
   powershellCopy

   Connect-SPOService -Url https://YOUR_TENANT-admin.sharepoint.com

3. List the OneDrive accounts that are available to restore. This only reads information. A personal site address looks like https://contoso-my.sharepoint.com/personal/user1_contoso_com. If the person's OneDrive is not listed, it has passed the 93 days or been permanently deleted.
   powershellCopy

   Get-SPODeletedSite -IncludeOnlyPersonalSite | FT url

4. Restore the OneDrive to an active state, replacing YOUR_ONEDRIVE_URL with the address from the list.
   powershellCopy

   Restore-SPODeletedSite -Identity YOUR_ONEDRIVE_URL

5. Give a named administrator access so the files can be copied out. Replace YOUR_ONEDRIVE_URL and YOUR_ADMIN_UPN with the OneDrive address and the administrator's sign-in name.
   powershellCopy

   Set-SPOUser -Site YOUR_ONEDRIVE_URL -LoginName YOUR_ADMIN_UPN -IsSiteCollectionAdmin $True

6. Copy out what you need and check it opens. When finished, take the temporary access away again using the same cmdlet with the flag set to false. Leave permanent deletion of the restored OneDrive until the owner of that data has confirmed they have everything, because a permanently deleted OneDrive cannot be restored.
   powershellCopy

   Set-SPOUser -Site YOUR_ONEDRIVE_URL -LoginName YOUR_ADMIN_UPN -IsSiteCollectionAdmin $False

When the recycle bins have run out

After the 93-day recycle pipeline finishes, SharePoint keeps backups of its metadata for 14 days and Azure blob storage soft-delete gives a similar 14-day window. In practical terms, an administrator can ask Microsoft Support to restore a site collection from backup within 14 days of the actual deletion. It restores whole site collections only. It cannot restore an individual file, list or library. Treat it as a last resort for something large that has genuinely vanished, not a way of finding one spreadsheet.

Past that point, recovery depends on what existed before the deletion. Three things are worth knowing about, because none of them can be switched on retrospectively.

A retention policy in Microsoft Purview can keep a copy of deleted or edited content in a hidden Preservation Hold library. That is built for compliance rather than convenience: users cannot browse it, and content is reached through compliance tools such as eDiscovery. It only covers content that was in scope when the policy was applied.

Microsoft 365 Backup is Microsoft's own paid backup for SharePoint sites, OneDrive accounts and Exchange mailboxes. A SharePoint Administrator, Global Administrator or the dedicated Microsoft 365 Backup Administrator role can set it up, and it bills through an Azure subscription. Microsoft's list price is $0.15 per GiB per month of protected content, which includes second-stage recycle bin content, and restores are free. The recovery window is configurable from 3 months to 10 years, with restore points every 10 minutes for the previous two weeks and weekly after that. Full site or account restores roll the whole site or account back and overwrite later changes, while selected files and folders can only be restored from recovery points within the last 14 days. Microsoft says a new policy takes up to an hour to activate and about another hour to create restore points, so set it up before you need it.

Independent backup products for Microsoft 365 exist as well, and some are built on the same Microsoft platform. The NCSC's advice for small organisations is to copy everything the business needs to operate and to learn how to restore before you actually have to. That is the real argument for a backup: knowing in advance that you can get back more than the 93 days the recycle bin will give you.

Check the recovery worked, and what to do if an option is missing

Recovery is only finished when the people who use the data confirm it. Ask the owner or a team member to open a sample of files and check the folder structure rather than trusting a success message.

• Files open normally and sit in their original folders, with version history intact where you expect it.
• After a point-in-time restore, anything created after the restore point is in the recycle bin, and the RestoreLog file lists items that could not be restored.
• If Restore is missing on Deleted sites, make sure only one site is selected.
• If Restore this library is missing, you either do not have site admin permissions or you are in a classic library.
• If a file is absent from both recycle bins, it has been purged, either deliberately, by passing the 93 days or because the second-stage bin overflowed. Only a Microsoft Support backup request for a whole site collection within 14 days of actual deletion, or a retention policy or backup in place before the deletion, can help.
• If an item was deleted a long time ago and you only just noticed, check the date against the windows in this article before spending effort on a route that has already closed.