Blue Team of One field notes · security

HomeDigital ForensicsOneDrive & SharePoint preservation

Deep dive · Archived OneDrive

The archived OneDrive and the billing trap

A departed employee's 400 GB OneDrive gets auto-archived. Months later, someone needs one billing spreadsheet out of it. The "simple" reactivation can quietly switch on a tenant-wide recurring charge across every unlicensed OneDrive you own — here's how to get the data back without the surprise bill.

When an employee leaves, their mailbox usually gets converted to shared and their OneDrive lingers, unlicensed. What many admins don't realize is that Microsoft now auto-archives those unlicensed OneDrive sites into Microsoft 365 Archive — and once a site is archived, it's read-only and can't be opened until it's reactivated. That's fine, until the day someone needs a file out of one.

This is a real recovery, anonymized. The data came back. The interesting part isn't the PowerShell — it's the cost trap hiding behind the reactivate button, which can turn a one-off recovery into a permanent line item on the tenant's bill.

01The situation

One file, behind an archived 400 GB site.

A billing coordinator needed a revenue-tracker spreadsheet that lived in a former colleague's OneDrive. The colleague had left months earlier; the account was unlicensed, the mailbox already converted to shared. The shared file link returned an access error. Under the hood, the entire ~400 GB OneDrive site had been fully archived by Microsoft 365 Archive after the departure — so nothing in it could be opened until the site was reactivated.

02Rule out the free paths first

Before you pay to reactivate, confirm no free recovery route already covers the data.

Reactivating from Archive costs money, so the first job is to check whether the content is already preserved somewhere you can reach for free. Work through each:

Free pathCheckVerdict here
Litigation holdIs the mailbox/OneDrive on a LitHold?None applied
Retention policyDoes any policy cover OneDrive/SharePoint?Not covering OneDrive
eDiscovery holdIs the OneDrive a data source in any case?Not in any active case
Inactive mailboxIs there a preserved inactive mailbox?Mailbox only — no OneDrive content
Existing snapshot/exportWas the OneDrive previously exported?Prior snapshot was mailbox-only

All ruled out — the only copy of the file lived in the archived OneDrive. That's what forced the paid reactivation path, and made understanding the billing essential.

03Find the site and read its status

SharePoint Online PowerShell. One version gotcha up front.

Use Windows PowerShell 5.1, not PowerShell 7

The archive parameters (-ArchiveStatus) aren't reliably recognized in PowerShell 7. If a command errors with "parameter not found," you're almost certainly in 7 — close it, open Windows PowerShell 5.1 (the blue icon) as admin, reinstall the module, and retry.

Install-Module -Name Microsoft.Online.SharePoint.PowerShell -Force -AllowClobber
Import-Module Microsoft.Online.SharePoint.PowerShell
Connect-SPOService -Url https://contoso-admin.sharepoint.com

OneDrive URLs replace @ and . with underscores. If you're not sure of the exact suffix, try the vanity domain first, then the onmicrosoft.com form — or search by owner:

# read the site's status and, critically, its ArchiveStatus
Get-SPOSite -Identity "https://contoso-my.sharepoint.com/personal/departed_user_contoso_com" |
  Select-Object Url, Owner, Status, LockState, ArchiveStatus, StorageUsageCurrent

# can't find it by URL? search by owner, or check deleted sites
Get-SPOSite -Filter "Owner -eq 'departed.user@contoso.com'" -IncludePersonalSite $true
Get-SPODeletedSite -Identity "https://contoso-my.sharepoint.com/personal/departed_user_contoso_com"

The field that matters is ArchiveStatus. A healthy, open site reads NotArchived; the one here read FullyArchived with ~400 GB in StorageUsageCurrent — confirming the content was intact but locked away in Archive.

04The billing trap

This is the part nobody warns you about. Read it before you touch the reactivate button.

Here's the mechanism. Reactivating a single archived site has a modest one-time cost (roughly $0.60/GB — about $240 for a 400 GB site). Reasonable. But the reactivate button in the SharePoint Admin Center is greyed out until you enable "Manage archived unlicensed OneDrive accounts" billing — and enabling that isn't a per-site switch. It turns on tenant-wide pay-as-you-go billing for every unlicensed OneDrive you have.

Why that one toggle is expensive

A mature tenant can have hundreds of unlicensed OneDrives from years of departures — easily terabytes in aggregate. Flip the tenant-wide billing switch to reactivate one site, forget to flip it back, and you've signed the whole tenant up for a recurring monthly charge across all of them. The one-time $240 recovery quietly becomes a permanent line item measured in hundreds of dollars a month.

So the recovery has to be bracketed: enable billing → reactivate the one site → pull the file → turn billing back off. The turn-it-back-off step is the one that saves the tenant real money, and it's the one that's easiest to forget once the user has what they need.

05Reactivate, recover, then close the tap

The full sequence, in order.

# 1. enable billing (M365 Admin Center):
#    Settings > Org settings > Pay-as-you-go services > Storage > Archive
#    turn ON "Manage archived unlicensed OneDrive accounts"

# 2. reactivate the single site (Windows PowerShell 5.1)
Set-SPOSite -Identity "https://contoso-my.sharepoint.com/personal/departed_user_contoso_com" `
  -ArchiveStatus Reactivating

# 3. wait a few minutes, then confirm it flipped
Get-SPOSite -Identity "https://contoso-my.sharepoint.com/personal/departed_user_contoso_com" |
  Select-Object Url, ArchiveStatus, LockState, Status
# ArchiveStatus: NotArchived  ·  Status: Active  ·  LockState: Unlock

# 4. grant access / pull the needed file, confirm with the requester

# 5. CRITICAL — turn billing back OFF once recovery is confirmed:
#    M365 Admin Center > Org settings > Pay-as-you-go > Storage > Archive
#    SharePoint Archive: Off   ·   Manage archived unlicensed OneDrive accounts: Off

Once ArchiveStatus reads NotArchived and Status is Active, the site opens normally and you can grant the requester access to the file. The moment they confirm they've got what they need, go back and switch both Archive billing toggles off. That's what turns this from a recurring cost into a one-time one.

Get sign-off before you enable tenant billing

Enabling pay-as-you-go billing is a financial action with tenant-wide reach. Loop in whoever owns the M365 spend before flipping it, note the one-time vs. recurring distinction in your ticket, and record the exact time you turned it back off. That paper trail is what protects you if a charge shows up later.

The lesson

Recovering an archived OneDrive is easy; recovering it without committing the tenant to recurring cost is the actual skill. Rule out the free preservation paths first, understand that the billing toggle is tenant-wide, not per-site, bracket the reactivation, and always turn the tap back off the moment the file is in the requester's hands.

Further reading

Comments

Questions or corrections welcome. Sign in with GitHub to join the thread.