A Purview hold does not stop an unpaid OneDrive being deleted at day 365

An unlicensed OneDrive account that is neither relicensed nor covered by unlicensed-account billing is subject to deletion after 365 cumulative unpaid days, and a Purview retention policy or hold does not stop that. The rule has been in force since 1 July 2026, and the account leaves eDiscovery at day 275.

Last verified: 2026-08-20.

What Microsoft actually says

Manage unlicensed OneDrive user accounts carries the rule in one FAQ sentence: "If billing is not enabled for unlicensed OneDrive accounts, and accounts are still retained 365 days after becoming unlicensed, then the unlicensed accounts will be subject to deletion 365 days after being unlicensed even if retention policies, settings, or holds exist on the OneDrive account."

The page defines an unpaid account as one that "isn't covered by an applicable paid license or billing/storage option", and gives its milestones as day counts, not dates. A hold is neither a licence nor a billing option, and "The 365 days of nonpayment is cumulative."

flowchart TD
  accTitle: The cumulative unpaid clock on an unlicensed OneDrive account
  accDescr: Two bands on one axis. The upper band carries the published day counts, day 1 start, day 60 read only, day 93 archived, day 275 out of eDiscovery, day 365 subject to deletion, with the last interval marked as a derived 90 day window in which a search returns nothing. The lower band shows the counter pausing while billing is on.
  subgraph A["Published day counts"]
    direction LR
    D1["Day 1, clock starts"] --> D60["Day 60, read only"] --> D93["Day 93, archived"] --> D275["Day 275, out of eDiscovery"]
    D275 -->|"90 days, search finds none"| D365["Day 365, subject to deletion"]
  end
  subgraph B["The counter, vendor example"]
    direction LR
    C1["90 unpaid days"] --> C2["Billing on 60 days, count pauses"] --> C3["Billing off, 275 more, total 365"]
  end
  D1 -.-|"Backlog day 1 is 1 Jul 2026"| C1

Why it is easy to get wrong

That FAQ answer opens by saying archived accounts honour retention policies, settings and litigation holds when billing is enabled. The conditional reads as a description of the normal state rather than the precondition it is, and three further surfaces confirm the error.

Plan against the unlicensed-accounts page: it is the narrower and later statement, and neither dissenting page carries an unlicensed-account carve-out. OneDrive retention and deletion even contradicts itself, banner against body. The last row is why the belief survives testing. Admin-initiated deletion of a held account is genuinely blocked, and no page distinguishes it from service-initiated deletion at day 365.

What the misreading costs

The control stops enforcing without saying so. After deletion, "eDiscovery hold records remain, but held OneDrive content becomes unrecoverable", and retention policy or label assignments "can still appear healthy, but the target site no longer exists".

Ninety days earlier, the ability to answer disappears before the data does. From day 275 the account is out of eDiscovery while the content is still present, so a search returns nothing. An operator producing leaver data under a GDPR Article 15, DORA or NIS2 request reads a zero result as nothing responsive. Microsoft says it plainly: "customers should not rely on retention or legal hold settings alone to preserve content indefinitely in an unpaid, unlicensed OneDrive account."

Prerequisites

The SharePoint Online Management Shell, and, per the Get-SPOSite reference, "You need to be a SharePoint Online administrator and be a site collection administrator to run the cmdlet." No read-only role is documented. Stopping the clock needs more than a toggle: the unlicensed-accounts page says the unlicensed OneDrive accounts billing toggle "can only be enabled once a general pay-as-you-go billing method has been set up", and Set up Microsoft 365 Archive places that toggle on the pay-as-you-go services panel.

The read-only check

Enumerate the archived sites and keep the personal ones. The -IncludePersonalSite $true switch adds personal sites to the result, it does not restrict the result to them, so both commands filter on the OneDrive URL shape as well.

Connect-SPOService -Url https://<tenant>-admin.sharepoint.com

# Read only. Get-SPOSite returns objects. Nothing below writes.

# Archived by the service at 93 or more unlicensed days.
Get-SPOSite -IncludePersonalSite $true -Limit ALL -ArchiveStatus Archived |
    Where-Object { $_.Url -like '*-my.sharepoint.com/personal/*' } |
    Select-Object Url, Owner, ArchiveStatus, LockState

# Past the day 60 read-only enforcement, not yet archived.
Get-SPOSite -IncludePersonalSite $true -Limit ALL -ArchiveStatus NotArchived |
    Where-Object { $_.Url -like '*-my.sharepoint.com/personal/*' -and $_.LockState -ne 'Unlock' } |
    Select-Object Url, Owner, ArchiveStatus, LockState

Manage Microsoft 365 Archive says "OneDrive accounts (site template 21) can't be archived by admins", and that the service archives them at 93 or more unlicensed days.

Connect-SPOService -Url https://<tenant>-admin.sharepoint.com

# Read only. Get-SPOSite returns objects. Nothing below writes.

# Archived by the service at 93 or more unlicensed days.
Get-SPOSite -IncludePersonalSite $true -Limit ALL -ArchiveStatus Archived |
    Select-Object Url, Owner, ArchiveStatus, LockState

# Past the day 60 read-only enforcement, not yet archived.
Get-SPOSite -IncludePersonalSite $true -Limit ALL -ArchiveStatus NotArchived |
    Where-Object { $_.LockState -ne 'Unlock' } |
    Select-Object Url, Owner, ArchiveStatus, LockState

Two portal reads finish it. Two portal reads finish it. The SharePoint admin centre's detailed OneDrive accounts report gives each account's URL, title, storage used, unlicensed date, unlicensed reason and archive status, and the downloadable CSV of unlicensed accounts carries the deletion-scheduled column. The Microsoft 365 admin centre's pay-as-you-go services settings hold the toggle governing archived unlicensed OneDrive accounts. Billing off, plus rows in that report, means the counter is running.

Expected output

One row per personal site in the two states these filters cover. -ArchiveStatus accepts five documented values, NotArchived, FullyArchived, RecentlyArchived, Reactivating and Archived, so an account currently archiving or reactivating appears in neither command and has to be queried separately. Any row under Archived is an account the OneDrive service archived at 93 or more unlicensed days. That is a different count from the cumulative unpaid clock, which started on 1 July 2026 for accounts already unlicensed then, so an archived row proves exposure and says nothing about how far the deletion clock has run. An empty result means no personal site has reached service archival, not that no account is unlicensed. A LockState other than Unlock indicates the day 60 enforcement or an admin lock.

Side effects

None. Get-SPOSite returns objects and both portal steps are reads. Nothing assigns a licence, enables billing, reactivates an account or deletes anything.

Rollback

Nothing to roll back, because nothing changed. The remediation does need one: enabling unlicensed-account billing starts charges Microsoft publishes at USD 0.60 per GB to reactivate an account and USD 0.05 per GB per month for every unlicensed account over 93 days.

Limitations

The check proves an account is archived or locked. It does not read the cumulative unpaid day count, and no cmdlet or endpoint exposing it appears on any page read here, so the check finds exposure without ranking it. It also cannot see what has moved on: "Site collections in the Recycle Bin will not be retrieved by using the Get-SPOSite cmdlet." Three segments are excluded: "These changes don't apply to EDU, GCC, or DoD customers." No page read here states whether the unlicensed-account enforcement rule applies to Office 365 operated by 21Vianet or to any other sovereign cloud. OneDrive retention and deletion and Manage Microsoft 365 Archive mention 21Vianet only to route admins to a different admin centre sign-in, so treat sovereign clouds as undocumented for this rule.

Decision: act now

Act now, and the reason is the already-live default rather than the deletion date. The counter has advanced since 1 July 2026 with no admin action, Microsoft publishes no way to read it, and the remedy needs an Azure pay-as-you-go link that takes procurement time. Earliest deletion risk for the legacy cohort is 1 July 2027, so the spend can be scheduled. The enumeration cannot, because counted days cannot be reconstructed later.

This sits beside the read-only per-departure evidence work in the offboarding evidence product.