Share via

OneDrive data permanently deleted, but user could still access it days earlier - is any deeper review still possible?

Alvin Xuan 0 Reputation points
2026-04-20T17:14:32.96+00:00

We are seeking guidance on a Microsoft 365 / OneDrive for Business data-loss case and would appreciate any technical insight.

Timeline:

  • A user had Microsoft 365 Business Basic.

The subscription expired on 20 Dec 2025.

The user reportedly was still able to log in and access OneDrive on 17 Apr 2026.

On 20 Apr 2026, we reassigned a license and signed in again.

At that point, all OneDrive / SharePoint files were gone.

Microsoft Support advised that the OneDrive data is permanently deleted and not recoverable.

What we do not understand is this: Normally, after a subscription has passed its normal accessible stage, users should no longer be able to access the service in the usual way. Also, Microsoft documentation states that customer data might be deleted after 90 days and will be deleted no later than 180 days after cancellation. Because of this, we are trying to understand why the user could still reportedly access OneDrive on 17 Apr 2026, yet by 20 Apr 2026 the files were no longer available.

We also checked with PowerShell, including:

Get-SPODeletedSite -IncludeOnlyPersonalSite

Get-MgDirectoryDeletedItem

Get-EntraDeletedUser

These checks returned no relevant result.

My questions are:

If the user could still access OneDrive on 17 Apr 2026, what service state might that indicate?

Could that have been real file access, or only account/interface access?

Is there any additional technical method to verify the final deletion timeline of the OneDrive / SharePoint content?

If the deleted site no longer appears in Deleted Sites, is there any other supported way to validate the final state?

Has anyone seen a similar case where user access was still possible shortly before permanent deletion was confirmed?

This case is extremely serious because the missing files include more than 10 years of critical financial documents. We understand that standard recovery may no longer be possible, but we are trying to gather any technical explanation or remaining validation path that may still help.

Thank you in advance for any insight.We are seeking guidance on a Microsoft 365 / OneDrive for Business data-loss case and would appreciate any technical insight.

Timeline:

A user had Microsoft 365 Business Basic.

The subscription expired on 20 Dec 2025.

The user reportedly was still able to log in and access OneDrive on 17 Apr 2026.

On 20 Apr 2026, we reassigned a license and signed in again.

At that point, all OneDrive / SharePoint files were gone.

Microsoft Support advised that the OneDrive data is permanently deleted and not recoverable.

What we do not understand is this:
Normally, after a subscription has passed its normal accessible stage, users should no longer be able to access the service in the usual way. Also, Microsoft documentation states that customer data might be deleted after 90 days and will be deleted no later than 180 days after cancellation. Because of this, we are trying to understand why the user could still reportedly access OneDrive on 17 Apr 2026, yet by 20 Apr 2026 the files were no longer available.

We also checked with PowerShell, including:

Get-SPODeletedSite -IncludeOnlyPersonalSite

Get-MgDirectoryDeletedItem

Get-EntraDeletedUser

These checks returned no relevant result.

My questions are:

If the user could still access OneDrive on 17 Apr 2026, what service state might that indicate?

Could that have been real file access, or only account/interface access?

Is there any additional technical method to verify the final deletion timeline of the OneDrive / SharePoint content?

If the deleted site no longer appears in Deleted Sites, is there any other supported way to validate the final state?

Has anyone seen a similar case where user access was still possible shortly before permanent deletion was confirmed?

This case is extremely serious because the missing files include more than 10 years of critical financial documents. We understand that standard recovery may no longer be possible, but we are trying to gather any technical explanation or remaining validation path that may still help.

Thank you in advance for any insight.

Microsoft 365 and Office | OneDrive | For business | Other

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Tom O'Connor 0 Reputation points
    2026-04-24T09:53:44.5366667+00:00

    I'm facing the exact same issue where a OneDrive was accessible on an unknowingly unlicensed account and content was being uploaded within that 3 month window. The dates are coincidentally very similar to the dates shown here.

    Then site was just suddenly deleted and there is little to no trace of it. I can see in the OneDrive reports in M365 admin that the site existed and is now marked as being deleted and the newly created site is also shown.

    Running the PowerShell shows no deleted sites or anything like that.

    Pretty unacceptable to be honest. Have been having little to no luck getting any traction from Microsoft Support.

    Was this answer helpful?

  2. Alexis-NG 15,860 Reputation points Microsoft External Staff Moderator
    2026-04-20T18:01:38.5066667+00:00

    Hi Alvin Xuan,

    Thank you for your detailed explanation and for sharing the information available so far.

    To better understand the timeline, the most reliable approach is to review Microsoft 365 audit logs (if still available). These logs may help identify:

    • Any file-level activity around April 17 (to confirm actual access)
    • Any deletion-related events closer to when the data disappeared

    Additionally:

    • If the user account was deleted in Entra ID, that date can help determine when the OneDrive cleanup process began
    • If the user was not deleted, the behavior may instead relate to license expiration or unlicensed OneDrive lifecycle changes
    • Standard OneDrive recovery options (such as restore or deleted site recovery) are limited to defined retention windows, and if the site no longer appears there, it is typically beyond recovery

    Regarding the “14-day backup” mention, there is no officially documented OneDrive-specific recovery window of that duration. The supported recovery timelines are generally based on recycle bin (up to 93 days) or restore features (up to 30 days), depending on the scenario.

    User's image

    For more information, please consult:

    OneDrive retention and deletion - SharePoint in Microsoft 365 | Microsoft Learn

    What happens to my data and access when my Microsoft 365 for business subscription ends? | Microsof…

    Manage unlicensed OneDrive user accounts - SharePoint in Microsoft 365 | Microsoft Learn

    You can try the following methods to verify the information in the audit logs further than users deleted stage with a global admin role:

    Method 1: Using Purview

    Navigate to the Audit section.

    • Select the Start and End date and time range.
    • Apply filter for the following operations in the Activities - friendly names field. Deleted file, Recycled file, Deleted file from recycle bin, Deleted file from second-stage recycle bin
    • Hit the Search button to initiate the search.
      User's image
    • Once the search is completed, use the Export option to download the file deletion audit log report for offline access.
    • User's image

    Method 2: Using PowerShell

    Connect to Exchange Online PowerShell, using the below cmdlet.

    Connect-ExchangeOnline

    Execute the following cmdlet to identify the user who deleted the Microsoft 365 files.

    Search-UnifiedAuditLog -StartDate <mm/dd/yyyy> -EndDate <mm/dd/yyyy> -Operations FileDeleted, FileRecycled, FileDeletedFirstStageRecycleBin, FileDeletedSecondStageRecycleBin | Format-Table -Property RecordType, CreationDate, UserIds, Operations

    The result will look like this:

    User's image

    You can expand your audit process with the operations below to your need:

    -Operations "FileAccessed","FileDownloaded","FilePreviewed","FileDeleted","Recycled","SiteDeleted"

    If you want any information further than this state, Microsoft Support would be the only party able to confirm any backend timeline beyond what is visible in audit logs.

    Please reach out to Microsoft Support through the Microsoft 365 Admin Center so Microsoft can collect logs and investigate your issue. 

    Microsoft also provides customer service phone numbers based on your region. You can find the appropriate contact number here: Customer service phone numbers - Microsoft Support 

    This route ensures that a Microsoft support engineer can initiate a remote session to investigate backend configurations, run advanced diagnostic tools, and, if necessary, escalate the case to specialized teams with access to internal systems and logs. These backend resources are essential for resolving issues that go beyond what’s visible in the user interface.

    As community moderators, we’re here to guide you, but due to privacy and security limitations, we don’t have access to the backend tools required for a full resolution. For this reason, contacting Microsoft Support via the Admin Center is the most secure and efficient way forward.

     

    I hope this helps you resolve the issue quickly. I’m glad to assist and truly hope the information provided has been useful. Please feel free to reach out anytime if you need further assistance.  

    In the meantime, if you see my replies bring helpful information, please kindly accept it as an answer and vote it up by your original account, which raised this question. Once marked, it will automatically pin to top. As other users will also search information in this community, your valuable vote up will definitely also help other users who have similar queries easily to find the correct channel and useful information more quickly. 

    Thank you for your kindness and contributions to the forum.

    Note: To receive email notifications for updates on this thread, please follow the steps outlined in this documentation to enable email notifications.

    Was this answer helpful?

    0 comments
  3. Alvin Xuan 0 Reputation points
    2026-04-20T17:23:24.3+00:00

    Thank you again for the detailed explanation.

    Understood that the documented lifecycle points more to user deletion and OneDrive retention timing, rather than license expiry alone.

    At present, we only have confirmed login proof from 17 Apr 2026, and the affected user stated that files were accessible then. However, we do not currently have independent file-level evidence such as screenshots, downloads, or file access logs, so we understand we cannot conclusively distinguish real file access from interface-only access.

    Based on your explanation, it seems the most important remaining point is the actual timeline. Would you advise whether the best next step is to ask Microsoft Support to explicitly confirm:

    the Entra ID user deletion date, if any

    the configured OneDrive retention period for deleted users

    when the OneDrive retention clock actually started

    when the personal site entered deleted state / Deleted Sites

    when the 93-day Deleted Sites window ended

    whether the additional 14-day backup window was still available at any point around 20 Apr 2026

    Our goal now is to establish the exact timeline as clearly as possible, and to confirm whether 17 Apr 2026 could still have fallen within any remaining accessible or recoverable state.

    Thank you again for your guidance.

    Was this answer helpful?

    0 comments

  4. AI answer

    2026-04-20T17:15:06.95+00:00

    Based on the documented OneDrive/SharePoint lifecycle, the behavior described is consistent with normal retention and deletion processes, and there is no additional supported recovery path once all of the following are true:

    • The user object is no longer in Microsoft Entra ID (including Deleted Users).
    • The personal OneDrive site is no longer in the active sites list.
    • The personal OneDrive site is no longer in the SharePoint Deleted Sites list (Get-SPODeletedSite -IncludeOnlyPersonalSite returns nothing relevant).
    • The OneDrive content is not in the OneDrive/SharePoint recycle bins.

    Addressing the specific questions:

    1. What service state might it indicate if the user could still access OneDrive on 17 Apr 2026?

    The OneDrive deletion process is tied to user account deletion in Entra ID, not directly to license/subscription expiry:

    • When a user is deleted from Microsoft 365/Entra ID, the OneDrive retention period starts. The default is 30 days, configurable via Set-SPOTenant -OrphanedPersonalSitesRetentionPeriod.
    • During this retention period, the OneDrive remains accessible and shared content can still be accessed.
    • After the retention period ends, the OneDrive is marked for deletion and then moved to the site collection recycle bin for 93 days, where it can only be restored by a SharePoint admin using PowerShell.

    From the context:

    • “When you delete a user… the user's OneDrive is retained for the number of days you specify… The default is 30 days. During this time, other users can still access shared content. At the end of the time period, the OneDrive remains in a deleted state for 93 days and can only be restored by a SharePoint Administrator.”
    • “After seven days, the OneDrive for the deleted user is moved to the site collection recycle bin, where it's kept for 93 days.”

    The fact that the user could still sign in and “access OneDrive” on 17 Apr 2026 most likely indicates:

    • The Entra ID user account still existed (not deleted), even though the subscription/license had expired.
    • OneDrive was still provisioned and reachable, but the underlying retention/deletion clock (tied to user deletion) may have already run or not yet been triggered, depending on when/if the user account was actually deleted.

    Subscription expiry alone does not immediately delete OneDrive content; deletion is driven by account deletion and OneDrive retention settings. So the user being able to sign in does not contradict the possibility that the content was already in a late stage of the deletion lifecycle or had just been removed.

    1. Could that have been real file access, or only account/interface access?

    From the documented behavior:

    • While the OneDrive is in the retention period (after user deletion but before the OneDrive is moved to the site collection recycle bin), “other users can still access shared content.”
    • Once the OneDrive is moved to the site collection recycle bin, “users will no longer be able to access any shared content in the OneDrive.”

    This implies two distinct possibilities for what the user saw on 17 Apr 2026:

    • Real file access: If the OneDrive had not yet been moved to the site collection recycle bin, the user could still browse and open files.
    • Interface-only access / empty OneDrive: If the OneDrive had already been deleted (or moved to the recycle bin and then permanently removed), the user could still sign in to the OneDrive interface, but would see no content (an empty or partially empty library). The sign-in experience can persist even when the underlying site or content is gone.

    The context does not provide a way to distinguish retrospectively which of these occurred; it only defines that once the OneDrive is in the site collection recycle bin or permanently deleted, content is no longer accessible.

    1. Is there any additional technical method to verify the final deletion timeline of the OneDrive/SharePoint content?

    From the available documentation, the supported technical checkpoints are:

    • SharePoint Deleted Sites: Get-SPODeletedSite -IncludeOnlyPersonalSite and Get-SPODeletedSite -Identity <URL> to see if the personal OneDrive site is still in the deleted sites collection and restorable.
    • OneDrive/SharePoint recycle bins: First- and second-stage recycle bins for the site, where deleted sites are kept for 93 days after being moved there.
    • Microsoft Support backup window: SharePoint Online retains backups of all content for 14 additional days beyond actual deletion. Within that 14-day window, an administrator can contact Microsoft Support to request a restore of the site collection.

    From the context:

    • “After seven days, the OneDrive for the deleted user is moved to the site collection recycle bin, where it's kept for 93 days… To restore the OneDrive, you need to use PowerShell.”
    • “SharePoint Online retains backups of all content for 14 additional days beyond actual deletion. If content cannot be restored via the Recycle Bin or Files Restore, an administrator can contact Microsoft Support to request a restore any time inside the 14-day window. Restorations from backups can be completed only for site collections…”

    If:

    • The OneDrive site is not in active sites.
    • The OneDrive site is not in Deleted Sites (Get-SPODeletedSite -IncludeOnlyPersonalSite shows nothing relevant).
    • The 93-day recycle bin period plus the additional 14-day backup window have passed, or Support has already confirmed that no backup restore is possible.

    Then there is no further supported technical method in the service to verify or roll back to an earlier state. The exact internal deletion timestamp is not exposed via additional public APIs beyond what has already been checked.

    1. If the deleted site no longer appears in Deleted Sites, is there any other supported way to validate the final state?

    According to the documentation, once a OneDrive site has:

    • Exited the 93-day site collection recycle bin window, and
    • Exceeded the additional 14-day backup retention window (or Support confirms no backup is available),

    it is considered permanently deleted. There is no further supported mechanism to:

    • View it in Deleted Sites.
    • Restore it from service-side backups.
    • Query a deeper “archive” state.

    The only remaining validation is via Microsoft Support during the 14-day backup window. After that, the service treats the content as permanently removed.

    1. Has anyone seen a similar case where user access was still possible shortly before permanent deletion was confirmed?

    The provided context does not include case studies or examples of this exact pattern, but it does explicitly state that:

    • OneDrive retention and deletion are governed by the user deletion event and the configured retention period, not by license expiry alone.
    • Users can still access shared content during the retention period.
    • After the retention period, the OneDrive moves to the site collection recycle bin for 93 days, during which only admins can restore it.

    This makes it entirely possible for a user to:

    • Still sign in and see or access content at some point close to the end of the retention window.
    • Then find the content gone a few days later, once the OneDrive has been moved to the recycle bin and then permanently deleted after the 93-day + 14-day windows.

    In summary, given that:

    • PowerShell checks show no deleted personal site.
    • The user and site do not appear in deleted objects.
    • Microsoft Support has already indicated the data is permanently deleted.

    The situation aligns with the documented OneDrive deletion lifecycle. There is no additional supported technical method in the service to further investigate or recover the content beyond what has already been attempted.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.