Is bulk restore possible after retention policy enforcement deletes files from OneDrive Preservation Hold Library?

Shortening the retention period on a Purview retention policy for OneDrive can cause exactly what is being observed: items whose retention period has now expired are automatically deleted by the service and moved into the OneDrive Recycle Bin, with the deletion attributed to system processes rather than a user.

For OneDrive and SharePoint:

• When content is subject to a retention policy, changes and deletions are managed via the Preservation Hold Library (PHL).
• When the configured retention period expires, a timer job evaluates items and deletes those whose retention has ended. For sites/OneDrive, this deletion moves items to the second-stage Recycle Bin and then they are permanently deleted after 93 days.
• The service, not the end user, performs these deletions, which matches the “system account” behavior being seen.

From the documented behavior:

• Content in the PHL is periodically evaluated by a timer job. When content is older than its configured retention period and not awaiting disposition review, it is deleted from the PHL and from the original location if still present. For SharePoint/OneDrive, this cleanup job runs every seven days and uses the configured retention period as the decision point.
• For retain-and-delete configurations, when the retention period expires, items are moved to the second-stage Recycle Bin and then permanently deleted after 93 days. Microsoft explicitly notes that content is now permanently deleted only from the Recycle Bin; all content from the PHL flows through the second-stage Recycle Bin.
• When a retention policy is released for SharePoint/OneDrive, there is a 30‑day grace period where files continue to be added to the PHL and cleanup is suspended, but this exception does not apply when simply changing the retention duration to a shorter period for the same locations.

Given this, the behavior of older items being deleted and appearing in the Recycle Bin after the policy was changed to “2 years only” is consistent with the documented lifecycle: items whose age now exceeds the new retention period become eligible for deletion by the timer job and are moved into the Recycle Bin.

Regarding the specific questions:

1. Is this expected behavior when shortening a retention period in Microsoft Purview?
   Yes. Once the retention period is reduced, items whose age exceeds the new period are eligible for deletion by the retention engine. For SharePoint/OneDrive, those items are removed from the PHL and/or original location and moved into the second-stage Recycle Bin, from which they are permanently deleted after 93 days. This is the standard cleanup behavior described for the PHL and for retain-and-delete policies.
2. Is there any Microsoft-supported method (PowerShell, compliance tools, backend process) to restore these files in bulk?
   From the provided documentation, recovery is supported via the Recycle Bin mechanisms, not directly from the PHL:

• Items deleted by retention cleanup go through the second-stage Recycle Bin, which is visible to site collection admins and supports restore operations.
• The documentation does not describe any supported method to restore items directly from the PHL; it explicitly states that the PHL is a hidden system location not designed for interactive use and that editing, deleting, or moving files there is not supported.
• No PowerShell or backend API for bulk restore from the PHL is documented in the provided context.

Therefore, based on the context, the supported recovery path is to restore from the Recycle Bin (including second-stage) using the SharePoint/OneDrive UI. The context does not provide a Microsoft-documented PowerShell-based bulk restore method for this scenario.

3. Why would some files fail to restore or not be included in bulk restore operations?
   The documentation in the context does not enumerate specific causes for partial or failed bulk restore from the Recycle Bin. It does, however, clarify that:

• Items in the second-stage Recycle Bin are permanently deleted after 93 days. Items already beyond that window cannot be restored.
• Retention settings take precedence over the standard OneDrive deletion process. If retention has expired and the Recycle Bin lifecycle has completed, items are permanently deleted and are no longer recoverable.

Any finer-grained explanation for why some items in the Recycle Bin fail to restore (for example, conflicts, path issues, or per-item errors) is not covered in the provided context.

4. Is there any way to recover files directly from the Preservation Hold Library (if still available)?
   The documentation is explicit that:

• The PHL is a hidden system location and is not designed to be used interactively.
• It is not supported to edit, delete, or move automatically retained files in the PHL.
• Access to content in these files is via compliance tools such as eDiscovery, not for operational restore back into OneDrive.

Additionally, the cleanup process for the PHL:

• Deletes content from the PHL when the retention period has expired and moves it into the Recycle Bin for final deletion.

There is no documented, supported method in the context to perform a direct restore from the PHL back into the user’s OneDrive. The supported path is through the Recycle Bin lifecycle.

5. PowerShell-based recovery options / backend mechanisms / known limitations
   Within the provided context:

• PowerShell is mentioned only in relation to tenant-level settings that control whether users can delete labeled items (AllowFilesWithKeepLabelToBeDeletedSPO/ODB via Get‑PnPTenant/Set‑PnPTenant) and not for recovery or restore operations.
• Priority cleanup is described as a way to override holds and delete content (including PHL content) to reclaim storage, but it is a deletion mechanism, not a recovery mechanism.
• The PHL is explicitly not supported for direct manipulation, and no PowerShell or backend restore mechanism is documented.

Known limitations and behaviors from the context relevant to this scenario:

• Retention policies and labels always take precedence over the standard OneDrive deletion process; they can cause content to be deleted earlier or retained longer than the default OneDrive lifecycle.
• When retention settings are to retain and delete, expired content is moved to the second-stage Recycle Bin and then permanently deleted after 93 days.
• When a retention policy for SharePoint/OneDrive is released, there is a 30‑day grace period where cleanup is suspended, but this exception does not apply when simply shortening the retention period for existing locations.
• The PHL is not a supported restore source; it is a compliance store accessed via eDiscovery and subject to automated cleanup.

In practice, this means:

• The behavior after shortening the retention period is consistent with the documented lifecycle for retention and the PHL.
• Recovery is limited to what is still present in the Recycle Bin (including second-stage) within its 93‑day window.
• There is no documented Microsoft-supported PowerShell or backend method in the provided context to bulk-restore items deleted by retention enforcement beyond what the Recycle Bin UI offers.

References:

• Learn about retention for SharePoint and OneDrive
• Learn about retention policies and retention labels
• Override holds to clean up files for Copilot and reclaim storage
• OneDrive retention and deletion