Legal Hold Keeps Deleted Files Recoverable: OneDrive for Business Fix

When a legal hold is applied to a user’s OneDrive for Business, deleted files remain recoverable even after the user moves them to the recycle bin or permanently deletes them. This happens because the legal hold preserves all versions and deleted items in the Preservation Hold library, a hidden container that stores data for eDiscovery and compliance purposes. In this article, you will learn how to identify whether a legal hold is active, how to release it when it is no longer needed, and how to permanently remove files that are stuck in a recoverable state.

Why Legal Hold Keeps Deleted Files Recoverable

When a legal hold is placed on a OneDrive for Business site, the system creates a Preservation Hold library. This library is hidden from the user and stores all file versions and deleted items that would otherwise be purged. The hold can be applied in two ways:

Litigation Hold

An administrator enables Litigation Hold on the user’s mailbox or OneDrive site through the Microsoft Purview compliance portal. This hold preserves all content indefinitely or until a specific date. Deleted files remain in the Preservation Hold library and are accessible only through eDiscovery searches.

eDiscovery Case Hold

An administrator creates an eDiscovery case and places a hold on the OneDrive site. This hold is more granular and can target specific content, such as files containing certain keywords or created within a date range. Files under this hold are also stored in the Preservation Hold library.

The Preservation Hold library does not count toward the user’s OneDrive storage quota, but it does consume storage in the tenant. If the legal hold is never removed, deleted files remain recoverable indefinitely, which can cause confusion for users who expect files to be permanently gone after deletion.

Steps to Release Legal Hold and Permanently Remove Deleted Files

Follow these steps to identify and remove a legal hold, then permanently delete the stuck files.

1. Sign in to the Microsoft Purview compliance portal
   Open a browser and go to compliance.microsoft.com. Sign in with an account that has the eDiscovery Manager or Compliance Administrator role.
2. Locate the legal hold on the affected OneDrive site
   In the left navigation, select eDiscovery > eDiscovery (Standard). Open the case that contains the hold. Select the Holds tab. Find the hold that includes the user’s OneDrive URL. Note the hold name and the user’s OneDrive site URL.
3. Remove the hold from the OneDrive site
   Select the hold, then click Edit hold. In the Locations section, remove the user’s OneDrive site URL from the list. Click Save. The hold release takes effect within 24 hours.
4. Verify the hold is released using PowerShell
   Open Windows PowerShell as an administrator. Run the following commands to connect to SharePoint Online:
   Connect-SPOService -Url https://[tenant]-admin.sharepoint.com
Get-SPOSite -Identity [user's OneDrive URL] | Select LockState
   If the LockState property shows Unlock, the hold has been removed. If it shows NoAccess or ReadOnly, the site is still locked.
5. Unlock the site if it is still locked
   If the lock state is not Unlock, run:
   Set-SPOSite -Identity [user's OneDrive URL] -LockState Unlock
   This command immediately removes the site-level lock.
6. Sign in to the user’s OneDrive and check the recycle bin
   Open a browser and go to the user’s OneDrive URL. In the left navigation, click Recycle bin. If files appear here, select them and click Delete to permanently remove them.
7. Empty the second-stage recycle bin
   At the bottom of the recycle bin page, click Second-stage recycle bin. Select all files and click Delete. This step removes the files from the Preservation Hold library as well.
8. Confirm the files are no longer recoverable
   Run a test by searching for the deleted file names in the Purview compliance portal using the Content search tool. If the search returns no results, the files are permanently removed.

If Files Remain Recoverable After Releasing the Hold

In some cases, files may still appear in eDiscovery searches even after the hold is released. This section covers the most common reasons and their fixes.

The Hold Was Not Removed from All Locations

An eDiscovery case hold can include multiple locations, such as the user’s mailbox and OneDrive. If the hold is removed from the OneDrive site but remains on the mailbox, the files might still be preserved because the mailbox hold also captures OneDrive data when the user’s OneDrive is linked to the mailbox. To fix this, edit the hold again and verify that both the mailbox and OneDrive site are removed.

The Preservation Hold Library Still Contains a Copy

After the hold is released, the Preservation Hold library is not automatically emptied. You must manually delete files from the second-stage recycle bin as described in step 7. If you skip this step, the files remain in the library and can still be recovered by an administrator for up to 30 days after deletion.

Another Hold or Retention Policy Is Active

A different legal hold or a retention policy might be preserving the files. Check the Purview compliance portal under Data lifecycle management > Retention policies. If a policy covers the user’s OneDrive site, remove the site from that policy or modify the policy to exclude the files.

Legal Hold vs Retention Policy: Key Differences for OneDrive Files

Item	Legal Hold	Retention Policy
Purpose	Preserves data for eDiscovery and litigation	Manages data lifecycle and compliance requirements
Applied by	eDiscovery Manager or Compliance Administrator	Compliance Administrator
Scope	Specific user, site, or content	Entire tenant or specific locations
User visibility	Hidden from user	Hidden from user
Storage location	Preservation Hold library	Preservation Hold library (if retention requires preservation)
Release method	Remove hold from eDiscovery case or disable Litigation Hold	Delete or modify the retention policy
Impact on deleted files	Files remain recoverable indefinitely	Files remain recoverable for the retention period

After the hold is released, you can permanently delete files from the second-stage recycle bin. If a retention policy is still active, wait for the retention period to expire before deleting the files.

You can now identify and release a legal hold on a OneDrive for Business site. Next, verify that no other holds or retention policies are preserving the files. A concrete tip: use the Get-SPOSite -Identity [URL] | Select LockState PowerShell command to confirm the hold is removed before attempting to delete files from the recycle bin.