OneDrive for Business is Popular Storage for Microsoft 365 Applications
Microsoft 365 applications use OneDrive for Business for all kinds of purposes apart from being the place for users to store personal files. Whiteboards, Team meeting recordings, and Loop components are three application usages of its storage, including being deleted through the OneDrive for Business Recycle Bin. The net takeaway is that Microsoft 365 treats OneDrive for Business as a great location to hold many types of application data.
One big reason why is that once data is in OneDrive for Business instead of other repositories like the Azure-based blob storage originally used by Stream, the information is fully exposed to all the Microsoft 365 compliance, data governance, and lifecycle management functionality. Microsoft Search indexes the files stored in OneDrive for Business to make the content discoverable, and functionality like Microsoft Purview core and premium eDiscovery can interrogate the information when the need arises for an investigation.
Odd Statement in Microsoft Documentation
All of which then means that the statement in Microsoft documentation (Figure 1) saying “The Recycle Bin is not indexed and therefore searches do not find content there. This means that an eDiscovery hold can’t locate any content in the Recycle Bin in order to hold it” will probably come as an unpleasant surprise to compliance administrators.
Figure 1: OneDrive for Business deletion process and notes (source: Microsoft)
In a nutshell, Microsoft’s text implies that people can hide information they don’t want eDiscovery searches to find or hold by keeping it in the OneDrive for Business Recycle Bin. This might happen serendipitously (the user doesn’t realize that data governance oversight doesn’t apply to files in the OneDrive recycle bin) or deliberately (they do and want to take advantage of the fact). Either way, it’s not a good situation.
OneDrive Data Found by Content Searches
Such an assertion caused me to test if Microsoft 365 content searches (separate or as part of a standard eDiscovery case) can find items stored in the OneDrive for Business Recycle Bin. All my efforts to uncover a situation where a content search couldn’t find an item failed. Holds appear to work as well, and a retention label (a form of hold) doesn’t disappear when an item moves into the Recycle Bin.
I have no idea what Microsoft’s text means in practice. Perhaps some condition exists to prevent Microsoft Purview from placing a hold on items found in OneDrive’s recycle bin, but one thing is for sure, contrary to the documentation, searches can find items in OneDrive’s recycle bin (Figure 2).
Figure 2: A Microsoft 365 content search finds an item in the OneDrive for Business recycle bin
To test retention, I deleted an item from the first- and second-stage recycle bin. The item ended up in the OneDrive preservation hold library (select Site Contents from the cogwheel menu and you can open the library), and the item was there, waiting for its hold to expire.
Indexing of the Recycle Bin
It’s possible that the statement saying, “The Recycle Bin is not indexed” is accurate. It could be that the items in the recycle bin are in the index because Microsoft Search processed them in their original location. The OneDrive for Business browser interface doesn’t offer an option to create a file in the recycle bin, and while it might be possible to do such a thing using an API (those working on PnP might have a view on this), it would be an unusual thing to do. Maybe even a suspicious action too because what logical reason exists to create a file in a recycle bin?
Documentation Isn’t Always Accurate
This experience underlines once again that you cannot assume that documentation is 100% accurate, even if published with Microsoft’s imprimatur. It all depends on the knowledge and experience of the writer, especially their familiarity with the topic. And even people with bags of experience with a specific technology can screw up when it comes to describing how something works. A slip of the finger on the keyboard, a badly phrased sentence, or just an error in writing are all part and parcel of the writer’s life.
Make sure that you’re not surprised about changes that appear inside Office 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.
I assume the documentation is reflecting what is also shown in Road Map Feature ID: 67092. According to that, searching and exporting items from the Recycle Bin is a feature due for release in December 2022 and it is not possible now. Interesting that you seem to be able to do it though. 😉
Apart from the obvious impact on compliance/retention/eDiscovery, the point being made here is that you should never accept documentation as the absolute truth until you verify that what the documentation says is actually how things work…
In your investigation of the recycle bin – did you come across a way to change the 93 day limit on the recycle bin? (and funny store – I had one user who used their Outlook recycle bin as a management tool – not at all happy when their recycle bin was suddenly cleaned-up!)
{"id":null,"mode":"button","open_style":"in_modal","currency_code":"EUR","currency_symbol":"\u20ac","currency_type":"decimal","blank_flag_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/blank.gif","flag_sprite_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/flags.png","default_amount":100,"top_media_type":"featured_image","featured_image_url":"https:\/\/office365itpros.com\/wp-content\/uploads\/2022\/11\/cover-141x200.jpg","featured_embed":"","header_media":null,"file_download_attachment_data":null,"recurring_options_enabled":true,"recurring_options":{"never":{"selected":true,"after_output":"One time only"},"weekly":{"selected":false,"after_output":"Every week"},"monthly":{"selected":false,"after_output":"Every month"},"yearly":{"selected":false,"after_output":"Every year"}},"strings":{"current_user_email":"","current_user_name":"","link_text":"Virtual Tip Jar","complete_payment_button_error_text":"Check info and try again","payment_verb":"Pay","payment_request_label":"Office 365 for IT Pros","form_has_an_error":"Please check and fix the errors above","general_server_error":"Something isn't working right at the moment. Please try again.","form_title":"Office 365 for IT Pros","form_subtitle":null,"currency_search_text":"Country or Currency here","other_payment_option":"Other payment option","manage_payments_button_text":"Manage your payments","thank_you_message":"Thank you for supporting the work of Office 365 for IT Pros!","payment_confirmation_title":"Office 365 for IT Pros","receipt_title":"Your Receipt","print_receipt":"Print Receipt","email_receipt":"Email Receipt","email_receipt_sending":"Sending receipt...","email_receipt_success":"Email receipt successfully sent","email_receipt_failed":"Email receipt failed to send. Please try again.","receipt_payee":"Paid to","receipt_statement_descriptor":"This will show up on your statement as","receipt_date":"Date","receipt_transaction_id":"Transaction ID","receipt_transaction_amount":"Amount","refund_payer":"Refund from","login":"Log in to manage your payments","manage_payments":"Manage Payments","transactions_title":"Your Transactions","transaction_title":"Transaction Receipt","transaction_period":"Plan Period","arrangements_title":"Your Plans","arrangement_title":"Manage Plan","arrangement_details":"Plan Details","arrangement_id_title":"Plan ID","arrangement_payment_method_title":"Payment Method","arrangement_amount_title":"Plan Amount","arrangement_renewal_title":"Next renewal date","arrangement_action_cancel":"Cancel Plan","arrangement_action_cant_cancel":"Cancelling is currently not available.","arrangement_action_cancel_double":"Are you sure you'd like to cancel?","arrangement_cancelling":"Cancelling Plan...","arrangement_cancelled":"Plan Cancelled","arrangement_failed_to_cancel":"Failed to cancel plan","back_to_plans":"\u2190 Back to Plans","update_payment_method_verb":"Update","sca_auth_description":"Your have a pending renewal payment which requires authorization.","sca_auth_verb":"Authorize renewal payment","sca_authing_verb":"Authorizing payment","sca_authed_verb":"Payment successfully authorized!","sca_auth_failed":"Unable to authorize! Please try again.","login_button_text":"Log in","login_form_has_an_error":"Please check and fix the errors above","uppercase_search":"Search","lowercase_search":"search","uppercase_page":"Page","lowercase_page":"page","uppercase_items":"Items","lowercase_items":"items","uppercase_per":"Per","lowercase_per":"per","uppercase_of":"Of","lowercase_of":"of","back":"Back to plans","zip_code_placeholder":"Zip\/Postal Code","download_file_button_text":"Download File","input_field_instructions":{"tip_amount":{"placeholder_text":"How much would you like to tip?","initial":{"instruction_type":"normal","instruction_message":"How much would you like to tip? Choose any currency."},"empty":{"instruction_type":"error","instruction_message":"How much would you like to tip? Choose any currency."},"invalid_curency":{"instruction_type":"error","instruction_message":"Please choose a valid currency."}},"recurring":{"placeholder_text":"Recurring","initial":{"instruction_type":"normal","instruction_message":"How often would you like to give this?"},"success":{"instruction_type":"success","instruction_message":"How often would you like to give this?"},"empty":{"instruction_type":"error","instruction_message":"How often would you like to give this?"}},"name":{"placeholder_text":"Name on Credit Card","initial":{"instruction_type":"normal","instruction_message":"Enter the name on your card."},"success":{"instruction_type":"success","instruction_message":"Enter the name on your card."},"empty":{"instruction_type":"error","instruction_message":"Please enter the name on your card."}},"privacy_policy":{"terms_title":"Terms and conditions","terms_body":null,"terms_show_text":"View Terms","terms_hide_text":"Hide Terms","initial":{"instruction_type":"normal","instruction_message":"I agree to the terms."},"unchecked":{"instruction_type":"error","instruction_message":"Please agree to the terms."},"checked":{"instruction_type":"success","instruction_message":"I agree to the terms."}},"email":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email address"},"success":{"instruction_type":"success","instruction_message":"Enter your email address"},"blank":{"instruction_type":"error","instruction_message":"Enter your email address"},"not_an_email_address":{"instruction_type":"error","instruction_message":"Make sure you have entered a valid email address"}},"note_with_tip":{"placeholder_text":"Your note here...","initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"empty":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"not_empty_initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"saving":{"instruction_type":"normal","instruction_message":"Saving note..."},"success":{"instruction_type":"success","instruction_message":"Note successfully saved!"},"error":{"instruction_type":"error","instruction_message":"Unable to save note note at this time. Please try again."}},"email_for_login_code":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email to log in."},"success":{"instruction_type":"success","instruction_message":"Enter your email to log in."},"blank":{"instruction_type":"error","instruction_message":"Enter your email to log in."},"empty":{"instruction_type":"error","instruction_message":"Enter your email to log in."}},"login_code":{"initial":{"instruction_type":"normal","instruction_message":"Check your email and enter the login code."},"success":{"instruction_type":"success","instruction_message":"Check your email and enter the login code."},"blank":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."},"empty":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."}},"stripe_all_in_one":{"initial":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"empty":{"instruction_type":"error","instruction_message":"Enter your credit card details here."},"success":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"invalid_number":{"instruction_type":"error","instruction_message":"The card number is not a valid credit card number."},"invalid_expiry_month":{"instruction_type":"error","instruction_message":"The card's expiration month is invalid."},"invalid_expiry_year":{"instruction_type":"error","instruction_message":"The card's expiration year is invalid."},"invalid_cvc":{"instruction_type":"error","instruction_message":"The card's security code is invalid."},"incorrect_number":{"instruction_type":"error","instruction_message":"The card number is incorrect."},"incomplete_number":{"instruction_type":"error","instruction_message":"The card number is incomplete."},"incomplete_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incomplete."},"incomplete_expiry":{"instruction_type":"error","instruction_message":"The card's expiration date is incomplete."},"incomplete_zip":{"instruction_type":"error","instruction_message":"The card's zip code is incomplete."},"expired_card":{"instruction_type":"error","instruction_message":"The card has expired."},"incorrect_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incorrect."},"incorrect_zip":{"instruction_type":"error","instruction_message":"The card's zip code failed validation."},"invalid_expiry_year_past":{"instruction_type":"error","instruction_message":"The card's expiration year is in the past"},"card_declined":{"instruction_type":"error","instruction_message":"The card was declined."},"missing":{"instruction_type":"error","instruction_message":"There is no card on a customer that is being charged."},"processing_error":{"instruction_type":"error","instruction_message":"An error occurred while processing the card."},"invalid_request_error":{"instruction_type":"error","instruction_message":"Unable to process this payment, please try again or use alternative method."},"invalid_sofort_country":{"instruction_type":"error","instruction_message":"The billing country is not accepted by SOFORT. Please try another country."}}}},"fetched_oembed_html":false}
I assume the documentation is reflecting what is also shown in Road Map Feature ID: 67092. According to that, searching and exporting items from the Recycle Bin is a feature due for release in December 2022 and it is not possible now. Interesting that you seem to be able to do it though. 😉
The issue is bugged at https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/issues/3316.
Apart from the obvious impact on compliance/retention/eDiscovery, the point being made here is that you should never accept documentation as the absolute truth until you verify that what the documentation says is actually how things work…
In your investigation of the recycle bin – did you come across a way to change the 93 day limit on the recycle bin? (and funny store – I had one user who used their Outlook recycle bin as a management tool – not at all happy when their recycle bin was suddenly cleaned-up!)
No. It’s 93 days and that’s unlikely to change.
From the results returned, do you know if there is anyway to identify whether the file is in the recycle bin?
You’d have to check the recycle bin.