First: where was the file?
Files in Microsoft 365 live in one of two places. Personal work files are in OneDrive. Shared files are in SharePoint, even when you open them through Teams: every team has a SharePoint site, and the Files tab in a channel is a folder in that site. So to get a file back, you first need to know whether it was in someone’s OneDrive or on a team site. That decides which recycle bin you check and who can restore it.
Be careful with synced folders. Emptying a synced folder in File Explorer also deletes the files in OneDrive or SharePoint, and so for everyone who uses that folder. The OneDrive app warns about large deletions, but that warning is often clicked away.
The recycle bin: 93 days in two stages
A deleted file first goes to the recycle bin of the OneDrive or site. The user can restore it there themselves, and it returns to its original location. If the recycle bin is emptied, or someone deletes the file there again, it moves to the second-stage recycle bin. That is only visible to the OneDrive owner or a site admin. Together, the two recycle bins keep a file for 93 days, counted from the moment it was deleted. After that it is permanently gone from Microsoft 365.
A practical tip: search the recycle bin by name or sort by who deleted it. After a big clean-up you then see straight away which colleague deleted the files and when.
Overwritten or damaged: version history
A file that was overwritten is not in the recycle bin. That is what version history is for. OneDrive and SharePoint keep an earlier version with every change. Right-click the file, choose Version history and restore the right version, or open an old version first to check it is the correct one. This also works when someone has accidentally uploaded a completely different file with the same name.
How many versions are kept is set by an admin per library or for the whole organisation. Don’t cut the number of versions too far to save storage, because that removes exactly the safety net for overwritten files. With Office files that several people edit at the same time, you quickly get many versions per day.
Many files gone at once: restore OneDrive or a library
If hundreds of files have been deleted, moved or encrypted by ransomware, restoring them one by one is hopeless. With Restore your OneDrive a user rolls their entire OneDrive back to a point in the last 30 days. OneDrive shows an overview of all activity per day, so you can pick the moment just before the problem. For a SharePoint library, and so also for a team’s files, there is Restore this library in the library settings. A site admin can run it.
Keep in mind that restoring rolls back everything after that moment. Changes colleagues deliberately made afterwards are gone too. So agree on the moment first, and have people save their recent work separately if needed. If files were encrypted, treat it as a security incident first: find the cause and make sure the account or device is safe before you restore. See also our article on a compromised Microsoft 365 account.
When an employee leaves
When an account is deleted, that employee’s OneDrive is kept for 30 days by default. After that it is gone as well, including files that exist nowhere else. So make sure the manager or a colleague gets access to the OneDrive before the account is deleted and moves important files to a team site. An admin can extend the retention period for OneDrives of departed employees. Include this in your joiner and leaver checklist.
When you need a real backup
The recycle bin, version history and restore features are useful, but they are not a backup. They stop after 93 or 30 days, they live in the same environment as the original files, and an admin or attacker with the right permissions can empty them. If you only notice after three months that a folder is missing, or you need a file from last year, only a separate backup helps. Read more in why the cloud is not a backup and the 3-2-1 rule. If you must keep data for a fixed period for legal reasons, use retention policies, not the recycle bin.
If employees’ desktop files still live only on their laptop, none of this applies to them. With folder redirection to OneDrive they do fall under the recycle bin, version history and backup.
How Floor ICT handles this
Floor ICT agrees with you who may restore what: employees their own files, site admins the team sites, and us the larger restore jobs. We check the version settings and the retention period for OneDrives of departed employees, and give employees a short guide to recover a file themselves. We also set up a separate Microsoft 365 backup that goes back further than 93 days, and regularly test that restoring really works. That way a deleted folder is a small inconvenience, not a lost working week.