OneDrive Legal Hold Makes Deleted Files Reappear

You delete a file from OneDrive only to find it reappears minutes or hours later. This is not a sync glitch or a permissions error. The cause is a retention policy or legal hold applied to your OneDrive account by your organization’s compliance team. This article explains why legal hold overrides file deletion, how to identify if a hold is active, and what you can and cannot do to remove the reappearing files.

Legal hold, also called litigation hold or eDiscovery hold, preserves all file versions and deleted items indefinitely. When a hold is in place, the OneDrive Recycle Bin is effectively frozen. Even after you empty the bin, the files remain in a hidden preservation vault. The system then restores them to their original location during the next sync cycle.

This article covers the technical mechanism behind legal hold, how to check if your account is under hold, and the steps to request removal if you are a compliance officer or IT administrator. It also explains what happens when a hold expires and how to distinguish legal hold from other retention features.

Why Legal Hold Causes Deleted Files to Reappear in OneDrive

OneDrive legal hold is a compliance feature that preserves all data in a user’s OneDrive account when the organization has a legal or regulatory obligation to retain records. When a hold is active, the OneDrive sync engine does not treat file deletion as a permanent action. Instead, the system moves deleted files to the first-stage Recycle Bin, then after 30 days to the second-stage Recycle Bin, and finally to a hidden preservation vault that only the compliance admin can access.

However, because the hold policy requires that no content be permanently removed, OneDrive automatically restores files from the preservation vault back to their original folder during the next sync cycle. This restoration is not a bug — it is by design. The hold overrides the delete command at the storage level. The OneDrive client sees the file as missing, queries the server, and the server returns the file because the hold policy still considers it active content.

Three types of holds can cause this behavior:

• Litigation hold: Applied to a specific user’s mailbox and OneDrive through the Microsoft 365 admin center or Exchange Online PowerShell.
• eDiscovery hold: Applied to a case in the Microsoft 365 Purview compliance portal. It preserves OneDrive content related to a specific investigation.
• Retention policy with preservation action: A data lifecycle management policy that retains OneDrive content for a set period. If the policy is set to retain forever, it behaves like a hold.

Only a compliance administrator or global administrator can remove these holds. The end user cannot disable them.

Steps to Verify a Legal Hold Is Active on Your OneDrive

Before you request a hold removal, confirm that a hold is actually the cause of the reappearing files. Use one of these three methods.

Method 1: Check OneDrive Web Settings

1. Open OneDrive in a browser
   Go to onedrive.live.com and sign in with your work or school account.
2. Open account settings
   Select the gear icon in the top-right corner, then choose OneDrive settings.
3. Go to the Account tab
   Click Account in the left navigation panel.
4. Look for hold information
   Scroll to the bottom of the Account page. If a legal hold is active, you will see a section titled Hold information with text similar to: “Your OneDrive is on hold. Content you delete will be retained in accordance with your organization’s policies.”

Method 2: Use the Microsoft 365 Admin Center

1. Sign in to the Microsoft 365 admin center
   Go to admin.microsoft.com and sign in as a global administrator or compliance administrator.
2. Open the user management page
   Select Users > Active users and click the affected user’s display name.
3. Check Mail tab
   In the user details panel, click the Mail tab. Look for Litigation hold. If it says Enabled, the hold is active.

Method 3: Use Exchange Online PowerShell

1. Connect to Exchange Online PowerShell
   Open Windows PowerShell as an administrator and run: Connect-ExchangeOnline. Sign in with admin credentials.
2. Check litigation hold for the user
   Run: Get-Mailbox -Identity user@domain.com | fl LitigationHoldEnabled, LitigationHoldDuration. If LitigationHoldEnabled returns True, the hold is active.
3. Check eDiscovery holds
   Run: Get-Mailbox -Identity user@domain.com | fl InPlaceHolds. This lists all eDiscovery hold GUIDs applied to the user’s OneDrive.

If OneDrive Files Still Reappear After Hold Is Removed

Even after a hold is disabled, files that were preserved may reappear one more time during the next sync cycle. This happens because the preservation vault releases all retained items back to their original folders as part of the hold removal process. To prevent this, the compliance administrator should use the Purview compliance portal to permanently delete the preserved content before removing the hold.

OneDrive Files Reappear Even Though No Hold Is Active

If you have confirmed no legal hold or retention policy exists, the reappearance may be caused by a different feature: OneDrive Version History. When you delete a file, previous versions remain in the version history for up to 30 days. If another user or a sync conflict triggers a version restore, the file can reappear. Check the file’s version history by right-clicking the file in OneDrive web and selecting Version history. Delete all versions to stop the reappearance.

OneDrive Keeps Restoring Files After Legal Hold Expires

When a retention policy with a finite duration expires, OneDrive performs a final release of all preserved content. This can cause a batch of previously deleted files to reappear. To avoid this, the compliance administrator should use the Microsoft 365 Purview compliance portal > Data lifecycle management > Retention policies to set a disposition review or manually delete the preserved content before the policy expires.

Legal Hold vs Retention Policy vs eDiscovery Hold: Key Differences

Item	Legal Hold (Litigation Hold)	Retention Policy	eDiscovery Hold
Purpose	Preserve all content indefinitely for legal cases	Retain or delete content for a set period	Preserve content related to a specific investigation
Scope	One user’s entire OneDrive	All users or specific groups	Users included in an eDiscovery case
Duration	Indefinite until removed by admin	Fixed number of days or years	Indefinite until case is closed
End user visibility	Shown in OneDrive settings Account tab	Not visible to end user	Not visible to end user
File reappearance after deletion	Yes, files reappear automatically	Yes, if the policy action is “retain”	Yes, files reappear automatically
Can end user remove it	No	No	No

Now you know why deleted files reappear in OneDrive when a legal hold is active. Check your OneDrive settings Account tab to confirm the hold status. If you are a compliance administrator, use the Purview compliance portal to release or delete preserved content before removing the hold. To avoid surprises, always review retention policies before deleting files in bulk.