When a user is deleted in Microsoft 365, their OneDrive files remain accessible for 30 days. After this period, retrieving the data becomes more complex but is still possible up to six months after deletion. This guide will walk you through the process of recovering these files using PowerShell commands via the SharePoint Online Management Shell. Additionally, we’ll discuss the steps needed if the data has been archived to Azure Cloud Archives after six months.

In this Example we are retrieving a business OneDrive of a deleted user named: Ashly Jones. Now Note this method only work as long as OneDrive data was not sent the Microsoft data archives and can be recoverable through PowerShell commands.

Prerequisites

Before proceeding, ensure that you have the following:

1. SharePoint Online Management Shell installed on your system. You can download it from the Microsoft Download Center.
2. Global Administrator or SharePoint Administrator privileges in your Microsoft 365 environment.
3. The SharePoint Online URL of the deleted user’s OneDrive account.
4. The Login Name of an administrator account with sufficient permissions.

Step-by-Step Process to Recover Files

Step 1: Install and Set Up SharePoint Online Management Shell

Download and install the SharePoint Online Management Shell from the Microsoft Download Center. Once installed, open the tool and proceed to log in to your SharePoint Online environment.

Step 2: Log In to SharePoint Online Management Shell

Before running any commands, connect to the SharePoint Online Management Shell using the Connect-SPOService cmdlet. Replace the URL in the command with your organization’s admin URL:

Connect-SPOService -Url https://company_abc-admin.sharepoint.com -Credential (Get-Credential)

When prompted, enter your admin credentials.

Step 3: Restore the Deleted Site

The first step is to restore the deleted user’s OneDrive site using the Restore-SPODeletedSite cmdlet. Replace the URL in the command with the specific URL of the deleted user’s OneDrive site:

Restore-SPODeletedSite -Identity https://company_abc-my.sharepoint.com/personal/ashlyjones_company_abc_onmicrosoft_com

This command restores the deleted user’s OneDrive site.

Step 4: Grant Administrative Access

Once the site is restored, grant administrative permissions to an administrator account using the Set-SPOUser cmdlet:

Set-SPOUser -Site https://company_abc-my.sharepoint.com/personal/ashlyjones_company_abc_onmicrosoft_com -LoginName ADMIN@company_abc.onmicrosoft.com -IsSiteCollectionAdmin $True

In this command:

• Replace the -Site parameter with the URL of the restored OneDrive site.
• Replace -LoginName with the email address of an administrator account.

After executing this command, the specified administrator will have full access to the restored OneDrive site.

Step 5: Access and Download Files

Log in to the restored OneDrive site as the administrator and manually download the required files. Ensure that all critical data is secured.

Important Notes

1. Data Recovery After Six Months:
   • If the data was deleted over six months ago, it will likely be archived in Azure Cloud Archives.
   • Recovering data from Azure archives involves additional costs, as Microsoft charges a fee for accessing archived data.
2. Avoid Delays:
   • Always monitor the 30-day retention period and act promptly to avoid the complexities of post-30-day recovery.
3. Use Compliance Tools:
   • To avoid similar issues in the future, consider enabling retention policies in Microsoft 365 to ensure long-term preservation of critical data.

Conclusion

Recovering OneDrive files of a deleted user after 30 days but within six months is achievable using PowerShell and SharePoint Online Management Shell. Beyond six months, data retrieval from Azure archives incurs additional fees. Administrators should establish proactive data retention and backup policies to minimize disruptions and ensure seamless access to important files.

For more tips on managing OneDrive and SharePoint environments, stay tuned.