OneDrive Admin Checklist: file restore restores the wrong version for former employees

As an IT administrator, you might restore a former employee’s OneDrive files only to find that the wrong version appears. The restore process returns a snapshot from an unexpected date, not the files the user last worked on. This happens because OneDrive’s file restore feature works from a fixed point in time, and for former employees whose accounts were converted to shared mailboxes or deleted, the restore point may be outdated. This article explains why the wrong version is restored and provides a checklist to ensure you recover the correct files.

Why Restoring a Former Employee’s OneDrive Returns the Wrong Version

OneDrive’s file restore feature works by reverting an entire OneDrive to a point in time within the last 30 days. For a current employee, this is straightforward: you pick a date and time, and OneDrive restores the files as they existed at that moment. For a former employee, the situation is different. When an employee leaves, their OneDrive is often converted to a shared mailbox or deleted after a retention period. The restore point available through the admin center is tied to the account’s active state. If the user was deactivated more than 30 days ago, the restore point may be the last snapshot taken before deactivation, not the files the user was actively editing. Additionally, if the user had versioning disabled or if the account was converted to a shared mailbox, the version history may be truncated. The restore process does not account for the user’s last login date or the date the account was disabled. It simply uses the most recent available restore point, which could be weeks before the employee left. To get the correct version, you must first identify the exact date and time of the files you need.

The Role of Retention Policies

Retention policies in Microsoft 365 affect how long OneDrive files and versions are kept. If your organization has a retention policy that deletes OneDrive files 30 days after a user is deleted, the restore feature may only have access to the last snapshot before deletion. For former employees, the retention policy often starts when the user account is deleted, not when they left. This means the restore point may be from the day of deletion, which could be weeks after the employee stopped working. To avoid this, check the retention policy settings for the former employee’s OneDrive before attempting a restore.

Checklist to Restore the Correct OneDrive Version for Former Employees

Follow this checklist to ensure you restore the correct version of a former employee’s OneDrive files. Each step is critical to avoid restoring an outdated snapshot.

1. Identify the correct restore point date
   Open the Microsoft 365 admin center and go to Users > Active users. Find the former employee’s account. If the account is deleted, go to Deleted users. Note the date the user was deactivated or deleted. This date is the last possible restore point. If you need files from before that date, you must use version history or eDiscovery.
2. Check the OneDrive admin center restore availability
   In the OneDrive admin center, select the user’s OneDrive and click Restore OneDrive. The restore dialog shows the available restore points. If the only available point is before the employee left, proceed to the next step to use version history.
3. Use version history for specific files
   If you know the exact file names the employee worked on, use the OneDrive web interface to view version history. Sign in as a global admin, navigate to the user’s OneDrive, right-click the file, and select Version history. Download the version from the date you need. This method works only if the file wasn’t deleted.
4. Run an eDiscovery Content Search
   If version history is insufficient, use the Microsoft 365 compliance center. Go to eDiscovery > Content search. Create a new search with the query: site.path:"https://-my.sharepoint.com/personal/" AND lastmodifiedtime>= AND lastmodifiedtime<=. Replace placeholders with the tenant name, user’s email alias, and the date range you need. Export the results to a CSV file that lists file versions and their last modified dates.
5. Restore from the eDiscovery export
   Based on the eDiscovery results, identify the correct version date for each file. Use the OneDrive admin center restore feature with that specific date. If the date is outside the 30-day window, you cannot use the admin restore. Instead, export the files directly from eDiscovery by selecting the specific version and downloading it.
6. Verify the restored files
   After restoring, open a few files to confirm they match the expected version. Check the file metadata, such as last modified date and author, to ensure the correct version is in place. If files are still wrong, repeat the eDiscovery search with a narrower date range.

If the Restore Still Returns the Wrong Version

Even after following the checklist, you may encounter issues. Here are common failure patterns and how to address them.

The restore point is more than 30 days old

OneDrive’s file restore feature only covers the last 30 days. If the former employee left more than 30 days ago, the restore point will be the last snapshot before the 30-day window closed. In this case, you cannot use the admin restore. Use eDiscovery to search for files modified during the employee’s active period and export them directly. Alternatively, check if a backup solution like Microsoft 365 Backup or a third-party tool has a longer retention period.

Files were deleted before the restore point

If the employee deleted files before leaving, the restore feature may not recover them. OneDrive’s restore only reverts to a point where the files existed in the OneDrive. If the files were deleted earlier, they are not in the snapshot. Use eDiscovery to search the entire OneDrive, including the recycle bin. The recycle bin retains deleted files for 93 days. If the files are in the recycle bin, restore them from there before running the admin restore.

Version history is truncated after account conversion

If the former employee’s account was converted to a shared mailbox, version history may stop at the conversion date. This is because the OneDrive is no longer updated after conversion. To avoid this, convert the user’s OneDrive to a shared mailbox only after all files are backed up. If version history is truncated, use eDiscovery to search for files modified before the conversion date. The eDiscovery search can access the full version history up to the conversion date.

Admin Restore vs eDiscovery for Version Recovery: Key Differences

Item	Admin Restore (OneDrive admin center)	eDiscovery Content Search
Time range	Last 30 days only	All files and versions in the OneDrive, subject to retention policy
Granularity	Restores entire OneDrive to a single point in time	Exports specific files or versions by date range and query
Works for former employees	Only if the account is still active or deleted within 30 days	Works for any deleted or deactivated account as long as the data is retained
Requires admin permissions	OneDrive admin or SharePoint admin	eDiscovery Manager or Compliance administrator
Best use case	Quick restore when the correct date is within 30 days	Pinpointing exact file versions for former employees or when the restore point is wrong

Use admin restore for speed when the date is clear. Use eDiscovery for precision when restoring files for former employees.

Conclusion

You can now restore the correct OneDrive version for former employees by identifying the right restore point and using eDiscovery when the admin restore fails. Start by checking the user’s deactivation date and retention policy. Use version history for individual files or run an eDiscovery content search for bulk recovery. For a long-term solution, configure a backup policy that retains OneDrive versions for at least 90 days after an employee leaves. This ensures you always have access to the files from the employee’s last active period.