DEV Community

AdminPackStudio
AdminPackStudio

Posted on

Restore a deleted SharePoint site, OneDrive, or file in Microsoft 365 - step by step, with the time limits that matter

#microsoft #sharepoint #sysadmin #powershell

Restore a deleted SharePoint site, OneDrive, or file: step by step

"I deleted a folder last week. Can you get it back?" Usually yes, if you go to the right place before the clock runs out. Microsoft 365 has several separate recovery paths for SharePoint and OneDrive, each with its own time limit, and picking the wrong one wastes the window you have.

This is the hands-on version, ordered from smallest to largest restore. Time limits below are Microsoft's documented defaults at the time of writing. Retention policies, holds, and paid backup products can change what's possible, so check current docs and your own tenant's settings.

0. Before you restore anything

Ask four questions:

  1. What exactly is missing: one file, a folder, a whole library, a site, or a person's whole OneDrive?
  2. When was it deleted or changed? That decides which windows are still open.
  3. Deleted or overwritten? An overwritten or encrypted file needs version history or a library restore, not the recycle bin.
  4. Who's asking, and are they allowed to have it? Restoring someone else's OneDrive content is an access decision, not just a technical step. Get approval in the ticket.

1. One file or folder: the recycle bins

SharePoint and OneDrive have two recycle bin stages:

  • First stage (site Recycle bin): where deleted items go. The user who deleted the item can usually restore it themselves from Recycle bin in the site or in OneDrive.
  • Second stage (site collection recycle bin): where items go when they're deleted from the first stage, or emptied. A site collection admin can restore from here, via Recycle bin > Second-stage recycle bin at the bottom of the page.

Items are kept for 93 days from the original deletion in total, across both stages. Moving from first to second stage doesn't reset the clock.

Steps for the user:

1. Open the site (or OneDrive) > Recycle bin.
2. Find the item. Sort by "Date deleted" or search by name.
3. Select it > Restore. It goes back to its original location.
Enter fullscreen mode Exit fullscreen mode

If the item isn't in the first stage, a site collection admin checks the second stage. If it's in neither and it's less than 93 days old, check whether a retention policy kept a copy (section 6).

2. A file that was overwritten or corrupted: version history

If the file exists but its content is wrong:

1. In the library, select the file > ... > Version history.
2. Open older versions to find the last good one.
3. Restore that version. It becomes the new current version; the bad versions stay in history.
Enter fullscreen mode Exit fullscreen mode

This only works if versioning is on for the library, and how many versions are kept depends on the library and tenant settings. Check the library's versioning settings before you promise anything.

3. Many files at once: restore a library or OneDrive to an earlier time

For mass deletion, a sync client gone wrong, or ransomware that encrypted a lot of synced files, restoring one file at a time is hopeless. Use the time-based restore:

  • OneDrive: the user (or an admin with access) goes to OneDrive Settings > Restore your OneDrive.
  • SharePoint document library: Settings (gear) > Restore this library.

Then:

1. Pick a date, or "Custom date and time".
2. Use the activity chart and list to find the point just before the problem.
3. Select the activities to roll back to, then Restore.
Enter fullscreen mode Exit fullscreen mode

This works within the last 30 days. It rolls back everything after the point you pick in that library or OneDrive, including good changes. Warn the people who use that library first, and ideally have them copy any legitimate new work somewhere safe.

For ransomware, stop the spread first (isolate devices, follow your incident process) before rolling back. Otherwise the sync client may re-encrypt the restored files.

4. A deleted SharePoint site

Deleted sites go to Deleted sites in the SharePoint admin center and can be restored for 93 days.

Admin center:

1. SharePoint admin center > Sites > Deleted sites.
2. Select the site > Restore.
Enter fullscreen mode Exit fullscreen mode

PowerShell (SharePoint Online Management Shell):

Connect-SPOService -Url https://contoso-admin.sharepoint.com

# Read: list deleted sites
Get-SPODeletedSite | Select-Object Url, DeletionTime, DaysRemaining

# Change: restore one site
Restore-SPODeletedSite -Identity https://contoso.sharepoint.com/sites/Finance
Enter fullscreen mode Exit fullscreen mode

The SharePoint Online Management Shell module runs on Windows. Check current docs for the PowerShell versions it supports.

Group-connected and Teams sites are different. If the site belongs to a Microsoft 365 group, deleting the group deletes the site. Restore the group instead, within its 30-day soft-delete window, in the Microsoft 365 admin center (Teams & groups > Deleted groups) or the Entra admin center. Restoring the group brings back the site, mailbox, and Teams connection together. Restoring only the site can leave you with an orphaned site and a missing group.

After the group's 30 days, it's permanently deleted, and recovering the site alone gets harder. Know which kind of site you're dealing with before you start.

5. A leaver's OneDrive

When a user account is deleted, their OneDrive isn't deleted straight away:

  1. Retention period after user deletion: the OneDrive is kept for a set number of days (default 30, configurable). During this time, the user's manager or a configured secondary owner gets access, and an admin can grant access to someone else.
  2. After that period: the OneDrive is deleted and can be restored for 93 days by an admin.

Check your tenant's retention setting (read-only):

Get-SPOTenant | Select-Object OrphanedPersonalSitesRetentionPeriod
Enter fullscreen mode Exit fullscreen mode

List and restore a deleted OneDrive:

# Read
Get-SPODeletedSite -IncludeOnlyPersonalSite | Select-Object Url, DeletionTime, DaysRemaining

# Change
Restore-SPODeletedSite -Identity https://contoso-my.sharepoint.com/personal/leaver_contoso_com
Enter fullscreen mode Exit fullscreen mode

If the user account itself is restored in Entra within its 30-day soft-delete window, the OneDrive usually reconnects to it. The simplest prevention: disable leavers first and delete later, after the handoff of their files is done.

6. When the windows have closed

  • Retention policies (Microsoft Purview): if a retention policy covers the site, deleted or changed content may have been kept in the site's Preservation Hold library, and eDiscovery can search it. This is for compliance first. Copying content back is a manual process, and access needs the right Purview roles.
  • Microsoft support: for a whole site, Microsoft has documented that it keeps backups for a short period (14 days at the time of writing) and can restore an entire site collection on request. It's all or nothing for that site, and it isn't fast. Treat it as a last resort.
  • Third-party or Microsoft 365 Backup products: if your org has one, this is where it pays off. If you don't, this is the moment to write down which restores you couldn't do.

7. Quick reference

What's gone Where to restore Window (default) Who
File / folder deleted Site or OneDrive recycle bin 93 days total User, then site admin
File overwritten Version history Depends on versioning User / site owner
Many files changed Restore library / Restore your OneDrive 30 days User / site owner
Site deleted (not group) SharePoint admin > Deleted sites 93 days SharePoint admin
Group or Teams site deleted Restore the Microsoft 365 group 30 days Groups / Exchange / global admin
Leaver's OneDrive Retention period, then Deleted sites 30 days (configurable) + 93 SharePoint admin

Want the restore paths as a runbook?

The M365 Backup Awareness & Restore Runbook ($19) from Admin Pack Studio turns this into five Markdown modules: a retention vs backup decision worksheet, mail restore paths with a practice drill, OneDrive/SharePoint/Teams file restore paths with a ransomware card, a quarterly restore drill calendar with a record template, and a backup approach scoring matrix. It's docs only. It isn't backup software and doesn't restore anything for you.

Get the runbook: https://cashflow4375.gumroad.com/l/m365-backup-awareness-restore-runbook?utm_source=devto&utm_medium=article&utm_campaign=sharepoint_restore

Handling the leaver's mailbox too? The Exchange Online Admin Hygiene Pack ($29) covers shared mailbox conversion checks and permission reviews: https://cashflow4375.gumroad.com/l/exchange-online-admin-hygiene-pack

Admin Pack Studio. Not affiliated with Microsoft or any backup vendor. Microsoft 365, SharePoint, OneDrive, Teams, Microsoft Entra ID, and Microsoft Purview are Microsoft products. Operational guidance for admins authorized to manage their tenant. Not legal advice. Recovery windows and features change, so check current Microsoft documentation. Examples use placeholder names.

Top comments (0)