Microsoft OneDrive Unlicensed Account Data Expiry Policy

Starting in early July 2026, Microsoft will implement a structured lifecycle for unlicensed OneDrive accounts. This policy change means that once a user's license is removed or an account is deleted, a countdown to permanent data deletion begins. Organizations must audit their licensing and retention policies to prevent the loss of critical business data.

The Unlicensed OneDrive Lifecycle Timeline

Microsoft is introducing a formal enforcement period for data stored in unlicensed accounts. The process follows a specific timeline once a license is removed or a user is deleted:

  • Day 1: The retention countdown begins immediately upon license removal or user deletion.
  • Day 60: The account enters read-only mode. Users can view content but cannot make edits or add new files.
  • Day 93: The account is archived. Direct user access is blocked, though content remains available for eDiscovery and legal holds.
  • Month 12: Data is permanently and irreversibly deleted. This is a hard deletion, not a soft-delete, and the data cannot be recovered.

To reverse this process at any point before the 12-month mark, administrators can reassign a license or enable billing for the account.

Impact on Legal, eDiscovery, and GDPR Compliance

This new lifecycle creates significant risks for organizations relying on legal holds or GDPR requests.

Legal Holds and Retention Policies

Contrary to common assumptions, data can be deleted even if a retention policy or legal hold is in place. Licensing or billing must be restored first to protect the unlicensed data from the permanent deletion at the 12-month mark.

eDiscovery and Data Portability

Archived content remains searchable via eDiscovery until the final deletion date. However, once an account enters read-only or archived status, users can no longer access or export their own personal data, which may impact an organization's ability to fulfill GDPR right-of-access and data portability requests.

Strategies for Data Protection

Organizations have four primary options to prevent the loss of data from unlicensed accounts:

  1. Reassign a License: Immediately exits the account from the enforcement lifecycle.

  2. Enable Pay-As-You-Go Billing: Provides a way to keep data without requiring a full user license.

  3. Migrate Content: Move files to a shared SharePoint location or another OneDrive account before the deadline.

  4. Adjust Retention Policies: Configure policies to ensure data is removed only when it is no longer required.

Community Perspectives and Risks

Technical discussions among users and users on Hacker News highlight several concerns regarding this policy and the stability of the OneDrive ecosystem:

"This will have a huge impact on a lot of organisations, for example those that have a communal SharePoint, or shared document page: files shared from ex-employees for critical documentation is going to break."

Users have reported issues with automatic folder redirection (e.g., /c/Users/(name)) and data loss during sync errors. Some argue that the policy change is a reasonable expectation for a paid service, while others warn that the following risks are inherent to the cloud storage model:

  • Dependency on Licensing: The risk of a manager or HR representative being let go, leaving no one to transfer ownership of critical files before the deletion clock runs out.
  • Lack of Trust in Syncing: Reports of files becoming unreadable or lost during the implementation of backend bugs.
  • Administrative Overheads: The risk of notifications being missed by IT departments, leading to permanent data loss.

Summary of Action Items for Administrators

To avoid data loss, Microsoft 365 tenants worldwide will be affected by this change starting July 2026. Administrators should:

  • Audit unlicensed accounts currently sitting in the tenant.
  • Verify that critical documentation shared from individual OneDrive accounts is not stored in the user's personal drive rather than a shared SharePoint site.
  • Review legal hold processes to ensure they are not overridden by the new unlicensed data expiry policy.

Sources