The OneDrive for Business Recycle Bin, Searches, and Holds

OneDrive for Business is Popular Storage for Microsoft 365 Applications

Microsoft 365 applications use OneDrive for Business for all kinds of purposes apart from being the place for users to store personal files. Whiteboards, Team meeting recordings, and Loop components are three application usages of its storage, including being deleted through the OneDrive for Business Recycle Bin. The net takeaway is that Microsoft 365 treats OneDrive for Business as a great location to hold many types of application data.

One big reason why is that once data is in OneDrive for Business instead of other repositories like the Azure-based blob storage originally used by Stream, the information is fully exposed to all the Microsoft 365 compliance, data governance, and lifecycle management functionality. Microsoft Search indexes the files stored in OneDrive for Business to make the content discoverable, and functionality like Microsoft Purview core and premium eDiscovery can interrogate the information when the need arises for an investigation.

Odd Statement in Microsoft Documentation

All of which then means that the statement in Microsoft documentation (Figure 1) saying “The Recycle Bin is not indexed and therefore searches do not find content there. This means that an eDiscovery hold can’t locate any content in the Recycle Bin in order to hold it” will probably come as an unpleasant surprise to compliance administrators.

In a nutshell, Microsoft’s text implies that people can hide information they don’t want eDiscovery searches to find or hold by keeping it in the OneDrive for Business Recycle Bin. This might happen serendipitously (the user doesn’t realize that data governance oversight doesn’t apply to files in the OneDrive recycle bin) or deliberately (they do and want to take advantage of the fact). Either way, it’s not a good situation.

OneDrive Data Found by Content Searches

Such an assertion caused me to test if Microsoft 365 content searches (separate or as part of a standard eDiscovery case) can find items stored in the OneDrive for Business Recycle Bin. All my efforts to uncover a situation where a content search couldn’t find an item failed. Holds appear to work as well, and a retention label (a form of hold) doesn’t disappear when an item moves into the Recycle Bin.

I have no idea what Microsoft’s text means in practice. Perhaps some condition exists to prevent Microsoft Purview from placing a hold on items found in OneDrive’s recycle bin, but one thing is for sure, contrary to the documentation, searches can find items in OneDrive’s recycle bin (Figure 2).

To test retention, I deleted an item from the first- and second-stage recycle bin. The item ended up in the OneDrive preservation hold library (select Site Contents from the cogwheel menu and you can open the library), and the item was there, waiting for its hold to expire.

Indexing of the Recycle Bin

It’s possible that the statement saying, “The Recycle Bin is not indexed” is accurate. It could be that the items in the recycle bin are in the index because Microsoft Search processed them in their original location. The OneDrive for Business browser interface doesn’t offer an option to create a file in the recycle bin, and while it might be possible to do such a thing using an API (those working on PnP might have a view on this), it would be an unusual thing to do. Maybe even a suspicious action too because what logical reason exists to create a file in a recycle bin?

Documentation Isn’t Always Accurate

This experience underlines once again that you cannot assume that documentation is 100% accurate, even if published with Microsoft’s imprimatur. It all depends on the knowledge and experience of the writer, especially their familiarity with the topic. And even people with bags of experience with a specific technology can screw up when it comes to describing how something works. A slip of the finger on the keyboard, a badly phrased sentence, or just an error in writing are all part and parcel of the writer’s life.

---

Make sure that you’re not surprised about changes that appear inside Office 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.