When you restore files from a former employee’s OneDrive, you sometimes get an older version instead of the most recent one. This happens because the restore process uses a snapshot taken at the time the employee’s account was deleted or disabled, not the latest file state. The OneDrive retention policy and the timing of the account deletion determine which version is available. This article explains why the wrong version appears and how to retrieve the correct files.
Key Takeaways: Restoring the Correct OneDrive Version for Former Employees
- Microsoft 365 admin center > Users > Active users > OneDrive: Access the restore interface and select the right point-in-time snapshot based on the employee’s last sync date.
- OneDrive retention policy (default 30 days): Determines how long after account deletion you can restore files; the snapshot is frozen at deletion time, not at the employee’s last logon.
- PowerShell Get-SPOSite and Restore-SPOSite cmdlets: Provide granular control to restore specific file versions when the admin center shows the wrong snapshot.
Why the Restored Version Is Wrong
When a former employee’s Microsoft 365 account is deleted, OneDrive places a retention hold on the site. The snapshot available for restore is the state of the files at the moment of account deletion, not the state at the employee’s last logon or last file save. If the employee stopped syncing days or weeks before deletion, the snapshot is outdated. The restore process in the admin center always uses this frozen snapshot, so you see the version from the deletion date, not the latest version the employee worked on.
The default OneDrive retention period is 30 days after account deletion. During this period, you can restore the OneDrive to any point within the retention window, but only if you use the correct method. The admin center’s restore button only restores to the deletion snapshot. To get a newer version, you must access the OneDrive site directly or use PowerShell to restore from a more recent point.
Steps to Restore the Correct OneDrive Version
Follow these steps to identify the correct snapshot and restore the files the former employee last worked on.
- Check the employee’s last sync date in the audit log
Open the Microsoft 365 admin center and go to Compliance > Audit. Search for “File synced” events with the employee’s user principal name. Note the last sync timestamp. This is the version you want to restore. - Access the OneDrive site directly
In the admin center, go to Users > Active users, select the former employee, and click OneDrive. Click Access files. This opens the OneDrive site in a browser. If the site is still within the retention period, you can browse the files manually. - Use version history to restore a specific file
On the OneDrive site, right-click the file you need and select Version history. Look for a version timestamped near the last sync date you found in the audit log. Click the three dots next to that version and choose Restore. This replaces the current file with the correct version. - Restore the entire OneDrive to a point in time using PowerShell
If you need to restore many files, use the SharePoint Online Management Shell. RunConnect-SPOService -Url https://contoso-admin.sharepoint.com. Then runRestore-SPOSite -Identity https://contoso-my.sharepoint.com/personal/formeremployee_contoso_com -Time 2025-03-20T14:00:00Zusing the last sync date as the time parameter. This restores the entire site to that point. - Download the files after restore
After the restore completes, access the OneDrive site again. Select the folders or files you need and click Download. The files are now the correct versions.
If the Restore Still Shows the Wrong Version
The retention period has expired
If the account was deleted more than 30 days ago, the OneDrive may already be permanently deleted. Check the Deleted users list in the admin center. If the user is still listed, you can restore the account within 30 days of deletion. After that, the OneDrive is gone and cannot be recovered.
The employee used a personal device and never synced to OneDrive
If the employee saved files only locally and never synced them to OneDrive, no cloud version exists. In this case, you must recover the files from the employee’s local device if it is still available. OneDrive cannot restore files that were never uploaded.
The wrong user is selected
Verify you are restoring the correct user’s OneDrive. In the admin center, go to Users > Active users and confirm the user principal name matches the former employee. If multiple users have similar names, double-check the email address.
Admin Center Restore vs PowerShell Restore: Key Differences
| Item | Admin Center Restore | PowerShell Restore |
|---|---|---|
| Snapshot used | Always the deletion snapshot | Any point in time within the retention window |
| Granularity | Restores entire OneDrive only | Restores entire site or specific files with Restore-SPOSite |
| Time parameter | Not available | Accepts a Time parameter in UTC |
| Version history access | Not available in the admin center | Requires browsing the OneDrive site manually |
The admin center restore is fast but limited. PowerShell restore gives you control over the exact point in time. Use PowerShell when the admin center snapshot is outdated.
You can now restore the correct OneDrive version for former employees by checking the audit log for the last sync date and using PowerShell to restore to that point. If you need to recover files frequently, consider extending the OneDrive retention policy to 365 days in the admin center under Settings > Org settings > OneDrive > Retention. This gives you a full year to restore the correct version.