How to Recover a File From the Cloud Recycle Bin via PowerShell

When you delete a file from a synced cloud folder such as OneDrive or SharePoint, the file moves to the cloud recycle bin instead of being permanently removed. The standard way to restore it is through the web interface, but that process becomes slow and error-prone when you need to recover many files or automate the task. PowerShell provides a direct, scriptable method to recover files from the cloud recycle bin without opening a browser. This article explains how to use the SharePoint Online Management Shell and the Restore-PnPRecycleBinItem cmdlet to recover a file from the cloud recycle bin.

Understanding the Cloud Recycle Bin and PowerShell Recovery Options

The cloud recycle bin in Microsoft 365 consists of two stages. The first-stage recycle bin holds deleted items for 93 days for most users. When a user deletes an item from the first-stage recycle bin, or when the retention period expires, the item moves to the second-stage recycle bin, also called the site collection recycle bin. The second-stage recycle bin retains items for an additional 93 days, giving administrators a total of 186 days to recover a deleted file.

The web interface for the recycle bin works well for recovering one or two files. However, when you need to recover dozens of files, restore files based on a specific date range, or script the recovery process for multiple sites, PowerShell becomes the practical tool. The SharePoint Online Management Shell, built on the PnP PowerShell module, exposes the recycle bin as a collection of objects you can query, filter, and restore programmatically.

Before you begin, verify that you have the PnP PowerShell module installed. You need the SharePoint Administrator role or at least site-level owner permissions on the site where the file was deleted. The commands in this article work for both SharePoint Online document libraries and OneDrive for Business sites.

Steps to Recover a File From the Cloud Recycle Bin Using PowerShell

Follow these steps to connect to your site, locate the deleted file in the recycle bin, and restore it to its original location.

1. Install the PnP PowerShell module
   Open Windows PowerShell as an administrator. Run Install-Module PnP.PowerShell -Scope CurrentUser. If you already have the module installed, run Update-Module PnP.PowerShell to ensure you have the latest version. Press Y to confirm the installation when prompted.
2. Connect to your SharePoint or OneDrive site
   Run Connect-PnPOnline -Url "https://yourtenant.sharepoint.com/sites/yoursite" -Interactive. Replace the URL with your site collection URL. For OneDrive, use the format https://yourtenant-my.sharepoint.com/personal/user_domain_com. A sign-in dialog opens. Enter your Microsoft 365 credentials and complete any multi-factor authentication prompts.
3. List all items in the first-stage recycle bin
   Run Get-PnPRecycleBinItem | Select-Object Id, Title, DirName, DeletedDate. This command returns all items in the first-stage recycle bin. The output shows the unique ID, file name, original folder path, and deletion timestamp for each item. Note the Id of the file you want to recover.
4. Filter the recycle bin list to find your target file
   Run Get-PnPRecycleBinItem | Where-Object {$_.Title -eq "Report.xlsx"} | Select-Object Id, Title, DirName, DeletedDate. Replace Report.xlsx with your actual file name. If the file name includes spaces, wrap it in quotes. This filter returns only items that match the exact file name. To search by partial name, use -like "Report" instead of -eq.
5. Restore the file from the recycle bin
   Run Get-PnPRecycleBinItem | Where-Object {$_.Title -eq "Report.xlsx"} | Restore-PnPRecycleBinItem. This command pipes the filtered recycle bin item directly into the restore cmdlet. The file returns to its original folder location. You see a confirmation message in the console showing the restored file name.
6. Verify the file is restored
   Run Get-PnPFile -Url "Shared Documents/Report.xlsx". Replace the URL path with the original folder location of your file. If the file exists, the command returns its properties. You can also open the site in a browser and navigate to the original folder to confirm the file is present.

If the file is not in the first-stage recycle bin, it may be in the second-stage recycle bin. Run Get-PnPRecycleBinItem -SecondStage to list items in the second-stage recycle bin. Use the same filter and restore commands with the -SecondStage parameter.

Common Issues When Recovering Files From the Cloud Recycle Bin via PowerShell

“Access Denied” When Running Get-PnPRecycleBinItem

This error occurs when your account does not have sufficient permissions on the site. You need at least the Owner role on the site collection or the SharePoint Administrator role at the tenant level. Contact your tenant administrator to request the required permissions. After permissions are granted, run Disconnect-PnPOnline and then reconnect using Connect-PnPOnline with the same URL.

“The term ‘Restore-PnPRecycleBinItem’ is not recognized”

This error means the PnP PowerShell module is not loaded or is outdated. Run Import-Module PnP.PowerShell -Force to load the module. If the error persists, run Get-Module -ListAvailable PnP.PowerShell to check whether the module is installed. If it is not listed, install it using the command in Step 1 above.

File Restored to the Wrong Location or Not Restored at All

This issue happens when the recycle bin contains multiple items with the same file name in different folders. The Where-Object filter must include both the file name and the original folder path. Use $_.Title -eq "Report.xlsx" -and $_.DirName -eq "Shared Documents/Finance" to target the correct item. If the restore command runs without error but the file does not appear, check the second-stage recycle bin. The file may have been deleted from the first-stage recycle bin and moved to the second-stage bin.

PowerShell Session Times Out During Restore

Long-running restore operations can time out if the connection is idle. Use the -KeepConnection parameter when calling Restore-PnPRecycleBinItem. This parameter keeps the session alive until the restore completes. Alternatively, restore items in smaller batches by filtering by date instead of restoring all items at once.

PowerShell Recycle Bin Recovery vs Web Interface Recovery

Item	PowerShell Method	Web Interface Method
Setup time	Requires module installation and authentication	No setup required
Batch recovery	Supports filtering and restoring multiple files in one command	Manual selection of each file
Date-based filtering	Use Where-Object {$_.DeletedDate -gt "2025-01-01"}	No date filter available
Second-stage recovery	Use -SecondStage parameter	Navigate to site collection recycle bin
Automation support	Scriptable with scheduled tasks or Azure Automation	Not automatable
Permission requirement	Site owner or SharePoint Administrator	Site owner or member with delete permissions

The PowerShell method saves significant time when you need to recover files from multiple sites or restore items based on complex criteria such as deletion date and original folder path. The web interface remains faster for single-file recoveries when you already have the site open in a browser.

You can now recover files from the cloud recycle bin using PowerShell commands instead of navigating the web interface. Start by installing the PnP PowerShell module and connecting to your site with Connect-PnPOnline. For recurring recovery tasks, save the filter and restore commands in a .ps1 script file and run it as needed. An advanced tip is to combine Get-PnPRecycleBinItem with a date range filter to automatically restore all files deleted within the last 24 hours, which is useful for reversing accidental bulk deletions.