Home » Spin.AI Blog » Cybersecurity » Microsoft 365 » Step-By-Step OneDrive File Recovery for Office 365 Admins
June 24, 2021 | Updated on: April 23, 2024 | Reading time 10 minutes

Step-By-Step OneDrive File Recovery for Office 365 Admins

Avatar photo

Product Manager

Office 365 can give a wrong sense of security when it comes to data integrity. Many employees and even some admins perceive the cloud office as a backup. In reality, businesses do lose data stored in Microsoft services. In this article, we’ll tell you about OneDrive file recovery by answering the following questions:

  • What are the restoration limitations?
  • What methods can you use to recover data in OneDrive?
  • How to recover files in case of a ransomware attack?
  • What is the best option to recover deleted items from OneDrive?

OneDrive File Recovery in Office 365: Overview

Office 365 protects your data from error deletion by providing a two-stage recycle bin. These tools give users and Admins the opportunity to recover important files.

A deleted item first goes to a regular recycle bin. Then, after 93 days, Office moves it to the Site Collection Recycle Bin (also known as Second-Stage Recycle Bin). It keeps it there for 93 days and destroys it afterward. After this, the piece of data is not subject to recovery unless you have a third-party backup tool.

Another way to lose your business-critical data is to get hit by a ransomware attack. This malware won’t destroy your OneDrive files but it will encrypt their contents forcing you to pay the ransom. Finally, you might delete a user prior to copying their files or folders to a new destination.

Thereby OneDrive’s recovery of data depends on two main factors: the time of deletion and the method of deletion. The following table shows the cases of data loss on OneDrive and the methods to restore it.

Files deleted from OneDrive within the past 93 daysRetrieve from Recycle Bin
Files deleted from the Recycle Bin within the past 93 daysLook in the Site Collection Recycle Bin or:


Restore OneDrive to a Previous time

Files deleted from the Site Collection Recycle Bin for the past 14 daysContact Microsoft support
Files deleted because of account deletion in the past 30 daysRecover deleted user
Files encrypted by a ransomware
Files deleted earlier than 90 days
Files deleted from Site Collection Recycle Bin
Use backup

Find a detailed guide to each method in separate sections below.

To summarise this article chapter, we’d like to point out one important thing each admin should remember. Native tools that Microsoft provides for file recovery don’t cover all the cases of data loss. They have preset limitations that can’t be overcome. That is why we highly recommend backing up your data with third-party tools.

How to Recover OneDrive Files

This section contains detailed guidance for Admins on how to restore items from Recycle Bin.

First, you need to know how to set up OneDrive for file recovery:

1. Sign up as an Administrator and go to the Users section. Then, click on the User who lost data:

OneDrive File Recovery

2. In the right pop-up window, pick the tab OneDrive. Then click on Create link to files.

3. The link will redirect you to the OneDrive of the respective user.

Use OneDrive Recycle Bin

If the file you are looking for was deleted within the past 93 days, go to your user’s OneDrive and do as follows:

1. In the left panel, find Recycle bin.

2. Find the file you need to undelete and tick the box next to it.

3. In the upper panel click Restore selection.

Recover Deleted OneDrive files from Site Collection Recycle Bin

It’s possible that your user has emptied their OneDrive Recycle Bin (permanently deleted OneDrive deleted files). Another case is that more than 93 days have passed since the deletion. In this case, the file is most likely stored in the Second-stage Recycle bin. To recover deleted files from it follow the next steps:

1. Find the link to it, in the first-stage bin:

2. Look for the file you need to restore and check the box next to it.

3. Then click Restore Selection.

Restore OneDrive to a Previous Time

This is a rare option for Microsoft OneDrive file recovery. It reverses the user’s OneDrive to a previous state (for example, 2 days ago). Thereby all the changes that have been made to the files since that point to time are revoked.

If you decide to do it, follow the next steps:

1. Go to the user’s OneDrive and click on the Settings (gear icon) in the blue upper panel.

2. In the drop-down menu select Restore OneDrive.

3. You will be redirected to the respective page. You need to select the date as shown below:

4. Once you’ve selected the date, a table will appear. It lists all the changes that have been made to OneDrive files on that particular day.

5. Untick the changes you don’t want to keep. And click the restore button.


  • The restoration is only possible if the deleted files haven’t been removed from the Site Collection Recycle Bin.
  • It is also time-limited to the past 30 days.

Recover OneDrive files from deleted user

Sometimes you would need to restore files but the user has already been deleted. To retrieve them you need to recover OneDrive account.

Here’s what you need to do:

1. Sign in to Admin Center. Check if you have enough account licenses.

2. Go to the Users section and click on Deleted users.

3. You will be forwarded to the respective page. Once there, tick the user you need and click Restore.

4. Set the new password for the user. And wait for the system to recover deleted users in OneDrive for business.

5. Go to the restored account’s OneDrive as mentioned in the previous section. Then copy the files to a selected destination.

Have you lost an Outlook Email? Learn how to recover it.

OneDrive Ransomware Data Recovery

Modern ransomware leaves little to no options for recovery unless you pay the ransom.

Here’s what you should do before complying with the cybercriminals’ request for money:

1. Check if the previous versions of files are encrypted or not. Unfortunately, most of the modern ransomware types impact versions too. However, there’s always a chance that you got some old virus.

2. Look for a decryption key. Projects like NoMoreRansom, have tools to define your type of ransomware. They also provide decryption keys to the types of malware that they previously encountered.

OneDrive for Business File Recovery with SpinBackup

As we mentioned above, once your data reaches the time limitations of Office 365, it is lost forever. There’s nothing else you can do. To prevent this from happening we suggest using a third-party OneDrive backup and restore.

The benefits of backup solutions:

1. Compliance with the existing laws

The regulations in force require that companies back up certain types of data.

2. Data protection

Modern backup solutions like SpinOne store all your OneDrive files and their versions for as long as the subscription lasts.

3. Ease of use

Restoring data in OneDrive is a complex operation. Admins have to take many extra actions to restore a single file. SpinOne enables file recovery in several clicks in a single dashboard.

4. Ransomware protection – unique to SpinOne

Our tool has an AI that detects abnormal behavior in the cloud, identifies and stops ransomware, and then restores OneDrive files.

Was this helpful?

Thanks for your feedback!
Avatar photo

Product Manager

About Author

Will Tran is the Product Manager at Spin.AI, where he guides the product's strategic direction, oversees feature development and ensures that the solution solves his clients’ cybersecurity needs.

Will is a security professional who started his career at Lockheed Martin where he worked on National Security Space programs in business development and product management.

Will holds a BA in Economics and Mathematics from UCSB and an MBA with a specialization in Technology Management and Marketing from UCLA Anderson School of Management.

At Lockheed Martin, Will developed the multi-year strategy campaign and supported the product development of a national security satellite program for the United States Air Force, which resulted in a multi-billion dollar contract.

During business school, Will consulted 2 non-profit organizations as part of a series of national consulting case competitions. He set strategic priorities, optimized business operations, and developed a process to qualify new revenue streams for his non-profit clients. These initiatives resulted in 15-20% increase in annual surplus.

In his spare time, Will can be found at local coffee shops around Los Angeles, traveling to different countries, or hanging out with his cat.

How Can You Maximize SaaS Security Benefits?

Let's get started with a live demo

Latest blog posts

Beyond Add-Ons: Elevating Browser Governance Against Malicious and ...

Browser extensions, plugins, add-ons – these tools may have many names but they have even... Read more


Perception Point

backup comparison checlist

Regulations and Best Practices for Office 365 Backups: Europe Edition

Why do you need special accommodations for Office 365 Backups in Europe? For businesses using... Read more

Avatar photo

CEO and Founder

Top 10 Low-Risk Applications and Extensions for Google Workspace

Top 10 Low-Risk Applications and Extensions for Google Workspace

Google Workspace is an extremely popular SaaS productivity suite used by millions of organizations today.... Read more

Avatar photo

Vice President of Product