Big changes are on the horizon for how companies manage data for terminated employees.

Microsoft's updated data retention policy will be effective January 27, 2025. This shift will be crucial for organizations that have relied on shared mailboxes to retain former employees' OneDrive data. Let's break down what this policy change means and how it will impact your data management strategies.

Understanding the Policy Update

Traditionally, companies converted departing employees' accounts into shared mailboxes to retain access to their OneDrive data indefinitely. This practice ensured that essential files remained accessible to managers or designated users.

However, under the new policy, OneDrive data associated with terminated employees will be retained for only 30 days, or up to 93 days after the license is removed or deleted. Post this retention period, the data will either move to the recycle bin and be permanently deleted or be archived if subject to a retention policy.

Accessing archived files will incur reactivation fees and additional monthly storage costs. It's important to note that these changes do not apply to EDU, GCC, or DoD customers.

Implications for Data Management

This policy shift has several implications for organizations:

1. Limited Access Window: Organizations now have a constrained timeframe to access and retrieve OneDrive data from former employees. Beyond 30 to 93 days, data will be permanently deleted unless the account remains licensed.
2. Operational Adjustments: Companies must modify internal processes to ensure necessary data is retrieved within the specified period. This may involve setting up reminders or automated workflows to review and transfer critical files before the retention period lapses.
3. Revised Data Management Strategies: It's crucial to transfer important data to active accounts or shared drives before an employee's departure to prevent data loss.

Current vs. Future State

Currently, when a user is deleted or processed through the user deletion wizard, their OneDrive data is preserved for 30 days and then moved to a recycle bin, where it can be recovered by an admin using PowerShell for up to 93 days.

Custom retention policies can be configured in the SharePoint Admin Center or the Compliance Admin Center. If a user is unlicensed, their data can be retained indefinitely for OneDrive.

Starting January 27, 2025, deleted users will adhere to the existing default retention and deletion policies. If retention policies extend beyond the default 30 days, OneDrive accounts from deleted users will be archived after 93 days. Unlicensed accounts will also be archived after 93 days by default, regardless of retention policies.

Cost Considerations

Accessing files from archived accounts will require a reactivation fee of $0.60 per GB and a monthly storage fee of $0.05 per GB for all archived accounts, not just the one accessed.

For instance, if an organization has 100 unlicensed OneDrive accounts, each consuming 1 TB (totaling 100 TB), reactivating a specific account would incur substantial costs.

If No Action is Taken

Without proactive measures, unlicensed OneDrive accounts older than 93 days will be automatically archived and become inaccessible unless reactivated, incurring additional costs. Accounts without a custom retention policy will have their data moved to the recycle bin for another 93 days before permanent deletion.

Recommended Actions for Organizations

1. Inform Stakeholders: During the offboarding process, grant another user (typically the manager) access to the departing employee's OneDrive for 30 days to retrieve necessary data, with an additional 93 days for admins to recover data from the recycle bin.
2. Obtain Client Agreements: Have clients sign waivers agreeing to pay fees for additional storage if needed, clarifying cost implications and preventing future disputes.
3. Utilize Third-Party Backup Solutions: Employ third-party backup solutions to restore data into a SharePoint site if necessary.
4. Assign Licenses: Reactivate a single user's OneDrive by re-adding a license to avoid the Microsoft 365 backup billing process, which charges for all archived data.
5. Create OneDrive retention policies: Custom retention policies can be configured in the SharePoint Admin Center or the Compliance Admin Center. If a user is unlicensed, their data can be retained indefinitely for OneDrive.

Conclusion

Microsoft's forthcoming data retention policy for terminated employees represents a significant shift in managing OneDrive data. By understanding these changes and implementing proactive strategies, organizations can ensure compliance and safeguard critical information.

Staying informed and prepared is essential to navigate these updates effectively, contact our team today to learn more about these changes and get support to set the best plan of action for your team.

References:

• Manage unlicensed OneDrive user accounts – SharePoint in Microsoft 365 | Microsoft Learn
• OneDrive retention and deletion – SharePoint in Microsoft 365 | Microsoft Learn
• Set the OneDrive retention for deleted users – SharePoint in Microsoft 365 | Microsoft Learn
• FAQ: Manage unlicensed OneDrive user accounts – SharePoint in Microsoft 365 | Microsoft Learn