Recover Deleted Files from OneDrive, SharePoint, or Teams

A missing Microsoft 365 file may have been deleted, moved, renamed, overwritten, or removed from your view. Start with the least disruptive checks and escalate quickly when the file is business-critical or many items are affected.

Before restoring anything

Record the file or folder name, expected location, owner, approximate deletion time, and who last edited it. Search OneDrive or the SharePoint site and check Recent activity. In Teams, remember that channel files are stored in SharePoint; use the channel’s Files area and select Open in SharePoint. A file shared in a Teams chat may be stored in the sender’s OneDrive instead.

Do not empty recycle bins, delete a replacement file, or reorganize the affected library while recovery is underway. If deletion is widespread or suspicious, pause and contact IT so audit logs, retention, and security evidence are preserved.

Restore from OneDrive

For a file in your own OneDrive:

1. Sign in to OneDrive on the web with the correct work or school account.
2. Select Recycle bin in the left navigation.
3. Select the file or folder, then choose Restore.
4. Confirm that it returned to the expected location and opens correctly.

Microsoft states that personal OneDrive accounts normally allow restoration of deleted files for 30 days. Work or school accounts normally retain them for 93 days unless the administrator changed the setting. Content permanently deleted from the OneDrive recycle bin cannot be restored through that recycle bin. Files shared with you but owned by someone else must usually be recovered by the owner or an administrator. Microsoft Support

If the file still exists but contains the wrong content, use Version history instead of deleting it. Microsoft 365 subscribers may also have the option to restore an entire OneDrive to an earlier point within the last 30 days. An entire-drive rollback affects many changes, so coordinate it with IT and other collaborators first.

A locally synchronized deletion may also appear in the Windows Recycle Bin or Mac Trash, but the web recycle bin should still be checked. Online-only files may not have a complete local copy.

Restore from SharePoint or a Teams channel

1. Open the SharePoint site where the item was stored. From a Teams channel, select Files, then Open in SharePoint.
2. Select Recycle bin from the site navigation or Site contents.
3. Select the item and choose Restore.
4. Verify the original library, folder, permissions, and file contents.

Users with edit permission may be able to restore items deleted by someone else. If the item is not in the first-stage site recycle bin, ask a site collection administrator to check the second-stage site collection recycle bin. Microsoft says SharePoint deleted items are retained for a total of 93 days from the original deletion. Emptying the first-stage bin does not restart that clock; the item spends only the remainder in the second stage. Microsoft Support

Restore parent objects first. For example, restore a deleted library before trying to restore a file that belonged to it. Microsoft notes that restoring an item recreates a deleted parent folder when needed, but does not necessarily restore every other item that folder once contained. If a file already exists at the original path, SharePoint may append a number to the restored name.

Limits and escalation

Contact IT immediately if the item is absent from both recycle-bin stages, was permanently deleted, belongs to a deleted user, may be subject to a legal hold, or represents a large-scale deletion. Provide the site URL, library, original path, file name, owner, deletion window, and business deadline. Administrators may have retention policies, audit records, or independent backups, but availability depends on configuration and elapsed time.

Do not assume Microsoft Support can recover content after retention has expired. Do not perform an entire OneDrive or library rollback without approval: it can reverse legitimate edits made by other people. For suspected malicious deletion or ransomware, report it as a security incident and avoid reconnecting affected sync clients until IT provides direction.