When you use OneDrive for Business file restore to recover a former employee’s files, you might end up with an older version instead of the most recent backup. This happens because the restore process relies on a specific snapshot of the OneDrive at the time the license was removed. The default restore point is often the day the user left, not the last file change. This article explains why the wrong version appears and shows you how to select the correct restore point.
Key Takeaways: Restoring the Correct File Version for a Former Employee
- Microsoft 365 admin center > Active users > Select user > OneDrive tab: Shows the available restore points and lets you pick a custom date and time.
- OneDrive file restore date picker: You must manually choose a date within the last 30 days to get the correct version, not the default license-removal date.
- PowerShell cmdlet Get-SPODeletedSite: Lists all deleted OneDrive sites and their retention period for former employees.
Why OneDrive File Restore Shows the Wrong Version for Former Employees
When an employee leaves your organization, the IT admin typically removes the user’s Microsoft 365 license. This action triggers a retention policy that keeps the OneDrive for Business site for 30 days by default. During this period, the OneDrive enters a soft-deleted state. The file restore feature in the Microsoft 365 admin center defaults to the date the license was removed, not the last file modification date. If the employee changed files on their last day before the license was removed, those changes are still present in the OneDrive. However, the restore point that the admin center shows by default is the snapshot taken at the moment the license was removed. If you run the restore without changing the date, you get the version from that snapshot, which may be older than the final changes the user made.
The restore feature works by reverting all files and folders in the OneDrive to a selected point in time. It does not preserve newer files unless you explicitly choose a later date. For a former employee, the available restore points are limited to the time between the license removal and up to 30 days prior. If the employee’s last working day was a week before the license removal, the default restore point might be the license removal date, which is after the employee stopped working. In that case, the restore would show files as they existed on that later date, which could be missing final edits. The opposite scenario is also common: if the license was removed immediately on the termination date, the default restore point is that termination date, and any files saved after that date by another user with delegated access would be lost.
Steps to Select the Correct Restore Point for a Former Employee
- Open the Microsoft 365 admin center as a global or SharePoint admin
Go to admin.microsoft.com and sign in with an account that has Global Administrator or SharePoint Administrator privileges. - Navigate to the former employee’s OneDrive
In the admin center, go to Users > Active users. Search for the former employee’s name. Select the user, then click the OneDrive tab. If the user is not listed, the OneDrive may have been deleted. In that case, go to Setup > Sites > Deleted sites and restore the site first. - Click Create Restore Point
On the OneDrive tab, click Create restore point. This opens the file restore page for that specific OneDrive. - Select a custom date and time instead of the default
On the restore page, you will see a date picker labeled Restore to a date. The default date is the day the license was removed. Click the date picker and select a date that matches the last day the employee was actively working. If the employee made changes on their last day, choose that date. If you need a specific hour, click the time dropdown and select the closest hour. The restore will revert all files to the state they were in at midnight of that date unless you also choose a time. - Confirm the restore
Review the summary that shows how many files will be affected. Click Restore. A confirmation dialog appears. Click Restore again to start the process. The restore can take from a few minutes to several hours depending on the number of files. You can leave the page and come back to check the status under Restore status in the same OneDrive tab. - Verify the restored files
After the restore completes, open the former employee’s OneDrive in your browser. Navigate to the folders that contained the critical files. Check the version history of a few key files to confirm the correct version is present. Right-click a file and select Version history to see the list of saved versions. The version that matches your selected restore date should appear at the top.
If the Correct Restore Point Is Missing or Unavailable
OneDrive was deleted more than 30 days ago
If the former employee’s OneDrive was deleted more than 30 days ago, the site is permanently removed and no restore is possible. The only option is to check if you have a backup copy in another location, such as a local backup or a third-party backup service. To prevent this in the future, set the OneDrive retention period to a longer duration in the SharePoint admin center under Settings > OneDrive retention. The maximum retention period is 3650 days.
Restore shows no files or an empty library
This typically means the restore point you selected is before the employee started using OneDrive or after all files were deleted. Verify the employee’s start date and last activity date. Use the OneDrive audit log in the Microsoft 365 compliance portal to see when files were last modified. Then repeat the restore with a date that falls between those two dates.
Another user already restored the OneDrive to a different point
If another admin ran a file restore for the same user to a different date, the later restore overwrites the previous one. You cannot merge two restore points. You must run a single restore to the date that contains all the files you need. If you need files from two different dates, restore to the later date first, then manually copy the files from the earlier date using the version history feature.
File Restore Default vs Manual Date Selection: Key Differences
| Item | Default Restore Point | Manual Date Selection |
|---|---|---|
| Date used | License removal date (or site deletion date) | Any date within the last 30 days |
| Files included | Files as they existed at the moment of license removal | Files as they existed at the selected date and time |
| Risk | May miss final edits or include changes made after the employee left | Requires manual verification of the correct date; risk of selecting the wrong date |
| Best for | Rapid recovery when exact version is not critical | Legal holds, compliance audits, or recovering specific final versions |
You now know that the default restore point for a former employee’s OneDrive is the day the license was removed, which is often not the correct version. By manually selecting the employee’s last working day as the restore point, you can recover the most recent files. After the restore, always verify a few file versions using the version history panel. For critical data, consider setting a longer OneDrive retention period in the SharePoint admin center to extend the recovery window beyond 30 days.