Microsoft Purview Hard Delete for OneDrive, SharePoint Planned for October 2026

Microsoft is preparing a consequential expansion to Microsoft Purview Data Lifecycle Management: a hard-delete option for Priority cleanup policies targeting OneDrive and SharePoint. The capability, tracked as Microsoft 365 Roadmap ID 561034, is listed as in development with general availability currently targeted for October 2026 in GCC, GCC High, and DoD environments. Its purpose is clear: allow authorized compliance teams to configure a Priority cleanup policy that permanently removes specifically scoped files without sending them through the normal SharePoint and OneDrive recycle-bin process.
That is a major change in the practical meaning of “delete” across Microsoft 365. Today, even Purview’s deliberately exceptional Priority cleanup mechanism for SharePoint and OneDrive overrides retention and eDiscovery holds but still moves affected files to the second-stage Recycle Bin, where they follow the usual retention window before permanent deletion. Microsoft’s Priority cleanup documentation describes that sequence as a safeguard designed to preserve a compliant deletion process. The roadmap item signals an option to bypass that final recovery layer when a customer’s legal, regulatory, security, or data-spillage obligations require faster and irrecoverable disposal.
For Windows and Microsoft 365 administrators, this is not simply another retention-policy checkbox. It is a new high-impact control that may change incident-response playbooks, storage-governance strategies, approval workflows, audit requirements, and the separation of duties between compliance, security, and legal teams.

---

Overview: From Controlled Deletion to Deliberate Irreversibility​

Microsoft Purview Data Lifecycle Management already gives organizations a framework to retain, review, and delete content in Microsoft 365. Retention policies generally apply consistent settings at a container level—such as a SharePoint site or OneDrive account—while retention labels enable item-level governance for files, folders, and other individual content. Microsoft’s retention guidance explains that labels can travel with content within a tenant, making them more granular than policy-based controls.
That flexibility is valuable, but it is intentionally conservative. Microsoft 365 retention is built around the principle that content subject to multiple retention settings should not be permanently deleted while another applicable configuration still requires it to be retained. The existing model prioritizes preservation, recoverability, and defensibility over speed. Microsoft’s SharePoint and OneDrive retention documentation explicitly notes that permanent deletion is suspended if the item remains subject to another retention policy, retention label, or eDiscovery hold.
Priority cleanup exists for the situations in which that default hierarchy is too restrictive. It allows customers to target files in SharePoint and OneDrive and override retention settings or eDiscovery holds. Microsoft positions the feature for circumstances such as cleaning up stale Teams meeting recordings and transcripts, reclaiming storage, responding to security or privacy incidents, and handling content that must be removed despite an existing preservation rule. Microsoft’s Priority cleanup documentation states that the capability is specifically intended to override existing holds in controlled circumstances.
The proposed hard-delete configuration goes one step further. Rather than using the recycle bin as the final stage before permanent removal, the new workflow is intended to let administrators select a hard delete behavior for a Priority cleanup policy and skip recycle bins entirely. According to Roadmap ID 561034, the feature is aimed at OneDrive and SharePoint content and will be delivered through Microsoft Purview’s web experience.
The distinction matters. A standard deletion path offers a recovery period. A hard-delete path is designed to make the removal final.

---

Why the Existing 93-Day Recycle-Bin Model Matters​

The new capability makes more sense when viewed against the normal SharePoint Online and OneDrive deletion architecture.
For content governed by a retention policy or retention label, Microsoft 365 can retain a copy in the Preservation Hold library if the original file is edited or deleted. When the relevant retention period expires, that content is moved to the second-stage Recycle Bin rather than deleted immediately. Microsoft’s detailed retention guidance for SharePoint and OneDrive says the platform uses this approach to reduce the risk of inadvertent data loss.
For ordinary deleted content, the first-stage and second-stage recycle bins share a 93-day retention period. A file can move through those stages before Microsoft permanently deletes it at the end of that time. The same documentation confirms that site collection administrators can access and restore content from the second-stage Recycle Bin, even though end users cannot see it in their normal recycle-bin interface.
This safety net has operational and legal value:

• Accidental deletion can be corrected without escalating to Microsoft support or restoring an entire site.
• Misconfigured retention rules are less catastrophic because content is not instantly unrecoverable.
• Administrators have a practical remediation window when a policy query catches more items than expected.
• Legal and compliance teams gain time to identify unexpected collateral impact from an automated cleanup.
• Storage cleanup is deliberately paced, avoiding an irreversible result from an administrative error.

Microsoft’s current Priority cleanup implementation retains much of that philosophy. Although Priority cleanup can override holds, files still go to the second-stage Recycle Bin and then follow the normal timing processes. Microsoft’s Priority cleanup guidance describes this as the existing behavior for OneDrive and SharePoint.
The roadmap’s proposed hard-delete option therefore does not merely accelerate a timer. It removes the mechanism that currently provides the final operational reversal point.

---

What Microsoft Purview Priority Cleanup Already Does​

Priority cleanup is not a general-purpose deletion feature for everyday content housekeeping. It is a specialized workflow within Data Lifecycle Management that uses automatically applied retention labels and policies behind the scenes. Microsoft says administrators do not manually manage those underlying labels, which can supersede standard retention behavior so users do not have to wait for the longest applicable retention period to expire. Microsoft’s Priority cleanup documentation describes the internal mechanism and its relationship to retention principles.

Policy scope and content targeting​

A Priority cleanup policy identifies content by query and can be configured with static or adaptive scopes. For SharePoint and OneDrive, it is designed to discover files that meet a defined condition, then apply a cleanup action after review and approval. Microsoft’s configuration guidance says administrators must decide between adaptive and static policy scoping before creating the policy.
That makes the query design exceptionally important. A query that is precise enough to identify a narrowly defined set of unwanted meeting recordings can be defensible. A query based on vague filenames, broad keywords, or incomplete metadata could expose large quantities of legitimate business records to deletion.

Override capability​

The feature’s exceptional power lies in its ability to override controls that usually prevent destruction of content. Microsoft documents that Priority cleanup can override retention settings, eDiscovery holds, and—in particular cases involving delete-only retention configuration—even Preservation Lock. Microsoft’s documentation calls out these overrides and the additional safeguards applied to the process.
This does not mean every protected file can be removed. Microsoft states that Priority cleanup cannot be used for content marked as a record or regulatory record. It also cannot remove material already copied into an eDiscovery review set; that data is instead removed when the eDiscovery case itself is deleted by an authorized administrator. Microsoft’s Priority cleanup guidance identifies both limitations.
Those exceptions are significant. They preserve a boundary between aggressive cleanup and formal records-management obligations. However, administrators should avoid interpreting them as a complete safety guarantee. A file that is not technically marked as a record may still be material to a legal matter, regulatory inquiry, contractual dispute, or internal investigation.

---

The Planned Hard-Delete Option Changes the Risk Profile​

The hard-delete capability listed in Microsoft 365 Roadmap ID 561034 is expected to let organizations choose a configuration in a Priority cleanup policy that bypasses recycle bins for OneDrive and SharePoint content. The roadmap entry currently lists the release status as in development, so organizations should treat the described availability and implementation timing as planned rather than final.

The likely operational benefit​

In a serious data-spillage scenario, a 93-day recoverability window may be the opposite of what the organization needs. Consider a document containing regulated personal data that was mistakenly uploaded to a broadly accessible SharePoint library, or a confidential file copied into an employee’s OneDrive and then shared externally. In these cases, security teams may need to remove the data as quickly and completely as possible after preserving the evidence required for investigation.
A direct hard-delete path can potentially improve several outcomes:

• Reduced residual exposure for files that must not remain recoverable in tenant recycle bins.
• Faster compliance execution when a regulatory or contractual obligation requires disposal rather than preservation.
• Cleaner data-spillage remediation when sensitive material was stored in the wrong Microsoft 365 location.
• More decisive storage cleanup for obsolete, high-volume files that remain protected by broad retention policies.
• Clearer finality when authorized stakeholders have determined that recovery must not be possible.

The value is particularly visible for recurring, storage-intensive artifacts. Microsoft identifies Teams meeting recordings and transcripts as typical Priority cleanup candidates because these files may be retained by broad policies even when their business value declines after a relatively short period. Microsoft’s retention overview specifically highlights such files as examples of content organizations may want to remove from SharePoint and OneDrive through Priority cleanup.

The central danger: no practical undo button​

The strength of hard delete is also its greatest risk. A mistaken query, malformed scope, incorrect exclusion, compromised admin account, or policy regression could permanently remove valuable data without the ordinary 93-day recovery path.
This danger is not theoretical. Retention systems routinely operate across millions of documents, layered policies, multiple jurisdictions, and changing organizational structures. The more automated the selection criteria, the more important it becomes to validate the exact results before a policy is activated.
A hard-delete configuration must therefore be treated like a privileged destructive operation—not as a routine extension of Microsoft 365 storage administration. In practical terms, it belongs closer to a production database purge or cryptographic-key destruction workflow than to an ordinary recycle-bin cleanup.

---

Built-In Safeguards Are Strong, but They Are Not a Substitute for Governance​

Microsoft already places substantial friction around Priority cleanup for SharePoint and OneDrive. Those controls should remain the minimum baseline when the new hard-delete setting arrives.

Separation of duties​

Microsoft requires at least one other person to approve deletion beyond the person who created the policy. Microsoft’s Priority cleanup documentation says that each item always needs approval from another person as a safeguard against accidental or malicious deletion.
Where an item is subject to an eDiscovery hold, an eDiscovery administrator must also approve the removal. Microsoft additionally requires a Priority Cleanup Admin approval for all policies. This layered process is meant to ensure that the person with the operational need to delete is not the only person deciding whether deletion should occur.
The most important governance principle here is straightforward: the policy author should not be the final authority for a hard-delete action. Organizations should formalize this separation even where Microsoft’s interface technically permits flexibility in staffing.

Simulation before activation​

For SharePoint and OneDrive Priority cleanup policies, simulation mode is required during the initial setup process. Microsoft says simulations let administrators validate sample results against their query and refine the policy before it reaches the approval stage. Microsoft’s documented creation process also requires a separate Priority cleanup administrator to review the results before the policy can be turned on.
Microsoft further prevents the last person to edit the policy from turning it on. That safeguard is particularly relevant to hard delete because it reduces the chance that one administrator can edit selection logic and immediately activate the destructive workflow without independent review.
Still, simulation is only as valuable as the review process around it. A sample result is not a substitute for analyzing:

• The sites and OneDrive accounts included in scope.
• The legal or regulatory status of the matching content.
• File extensions, metadata, owners, sensitivity labels, and retention labels.
• The possibility of false positives caused by naming conventions.
• Whether the query identifies copies, versions, or derivative content.
• The business impact if every matching item becomes unrecoverable.

Explicit acknowledgement and auditing​

Microsoft requires administrators to explicitly acknowledge that a Priority cleanup policy can override eDiscovery holds and other retention settings. Microsoft’s guidance describes this acknowledgement as a specific configuration step rather than a passive warning.
The feature also produces dedicated audit events for SharePoint and OneDrive. Microsoft identifies PriorityCleanupTagApplied for cases where an item is identified and an existing retention label is removed, and PriorityCleanupFileRecycled for file deletion performed through Priority cleanup. Administrators can use the policy’s Cleanup ID as a keyword when investigating the relevant audit trail. Microsoft’s monitoring documentation outlines both events and the recommended tracking approach.
When hard delete becomes available, organizations should verify whether Microsoft introduces a distinct audit operation for the recycle-bin bypass. Until Microsoft publishes final technical documentation, administrators should not assume that an existing recycle-related audit event fully captures the new irreversible action.

---

A Safer Operating Model for Hard Delete​

The new setting may be appropriate, but only under a written procedure that is stricter than standard retention administration. The workflow should assume that the organization may later need to demonstrate why content was destroyed, who approved it, what was in scope, and how it was verified.

1. Classify the request before creating a policy​

Every hard-delete request should be categorized. The category determines who must approve it and what evidence must be preserved before deletion.
Useful classifications include:

1. Security incident or data spillage
   Sensitive information was stored, shared, or exposed in an unauthorized location.
2. Privacy or regulatory deletion obligation
   A valid obligation requires removal of a defined set of content.
3. Legal direction to dispose
   Counsel has determined that content is not subject to a preservation obligation and should be removed.
4. Storage governance exception
   High-volume stale data must be destroyed despite broad, otherwise legitimate retention coverage.
5. Administrative correction
   A prior configuration produced unwanted retained copies or preservation artifacts.

The most dangerous category is storage governance. Storage pressure can create urgency, but it rarely justifies skipping a recovery layer without a fully documented risk assessment.

2. Freeze the policy definition before approval​

The query, scope, exclusions, time range, and target locations should be exported or otherwise preserved in the change record before activation. This record should include the expected file count, storage estimate, site list, policy author, approving administrators, legal sign-off where needed, and business owner.
If a policy changes after a simulation, it should be treated as a new destructive request and rerun through review. Microsoft’s required editing and activation separation is helpful, but organizations should add a procedural control requiring a renewed approval when selection logic changes materially. Microsoft’s setup guidance confirms that policies can be edited and simulations rerun before activation.

3. Preserve investigation evidence separately​

In a spill or suspected compromise, deleting exposed data does not remove the need to preserve evidence of the incident. Security teams may require hashes, filenames, locations, permissions, sharing history, timestamps, audit records, and copies held in an authorized investigation repository.
This creates an important distinction: destroy the inappropriate tenant copy, not the evidence needed to explain and remediate the event. Since Priority cleanup can override eDiscovery holds, legal and investigation teams must be involved before any policy is allowed to purge content that could be relevant to a dispute or inquiry.

4. Use least-privilege roles and time-bound access​

Microsoft requires the Priority Cleanup Admin role to manage SharePoint and OneDrive Priority cleanup policies, while separate content-viewer roles are needed to review item details in simulation and approval stages. Microsoft’s role requirements provide a useful technical baseline.
Organizations should go beyond permanent role assignment:

• Use privileged identity management or just-in-time elevation where available.
• Require multi-factor authentication and hardened admin workstations.
• Restrict Priority Cleanup Admin membership to a small, named group.
• Review role assignments after each high-risk deletion event.
• Separate policy authoring, business approval, legal approval, and final execution whenever feasible.

5. Validate the completed action​

A hard delete should result in a formal completion report, not a silent closed ticket. The report should reconcile the approved item count with the actioned count, record exceptions, preserve audit-search results, and identify whether any files could not be processed.
Microsoft says a Priority cleanup policy may take up to seven days to reach an Enabled (Success) status after it is activated. Microsoft’s documentation also distinguishes between simulation counts and eventual match counts. That timing and counting behavior reinforces the need for post-action verification rather than assuming that a policy completed exactly as expected.

---

What This Means for Retention Strategy​

The availability of hard delete should not prompt organizations to weaken standard retention policies. In fact, it should do the opposite: force a more disciplined separation between normal lifecycle management and exception-based destruction.
Normal retention policies should remain the default for documents, collaboration spaces, project files, and employee data. Microsoft notes that retention policies are efficient for applying common settings across a site or mailbox, while retention labels are appropriate where item-level variation is needed. Microsoft’s retention documentation provides that distinction.
Hard-delete Priority cleanup should be reserved for circumstances where ordinary lifecycle processing is demonstrably insufficient. A sensible policy hierarchy would look like this:

• Retention policy or label: Standard governance and routine lifecycle handling.
• Disposition review: Controlled human decision-making for records that require formal disposal authorization.
• Priority cleanup with recycle-bin processing: Exceptional cleanup where holds must be overridden, but recoverability remains appropriate.
• Priority cleanup with hard delete: Rare, high-risk, fully authorized removal where recycle-bin recoverability itself is unacceptable.

That hierarchy preserves the intent of Microsoft Purview: keep content when preservation is required, delete it when disposal is authorized, and make exceptional destruction both difficult and auditable.

---

Availability, Scope, and What Administrators Should Watch Next​

Microsoft 365 Roadmap ID 561034 lists the hard-delete capability for Microsoft Purview, OneDrive, and SharePoint, with a General Availability target of October 2026 for GCC, GCC High, and DoD. Because the roadmap marks the feature as in development and Microsoft notes that roadmap timing and details can change, tenant administrators should avoid designing production controls around the expected date alone. Microsoft’s roadmap page describes its dates as estimates subject to change.
The most important details to monitor when Microsoft publishes final documentation are likely to include:

• Whether hard delete is an optional per-policy selection or a tenant-wide setting.
• Which Priority cleanup approval stages are mandatory for hard-delete policies.
• Whether deletion is item-specific, batch-based, or both.
• The audit operation names and retention period for hard-delete events.
• The treatment of file versions, Preservation Hold library copies, and shared-file derivatives.
• Whether hard delete has separate limitations for sensitivity-labeled or encrypted content.
• Any licensing prerequisites or Purview role changes.
• The precise behavior when target files are already in a recycle bin or are tied to a deleted OneDrive account.

Microsoft’s current documentation makes clear that recycle-bin content is not indexed and cannot be found by an eDiscovery search for the purpose of placing it on hold. Microsoft’s SharePoint and OneDrive retention documentation That existing limitation helps explain why bypassing recycle bins may appeal in targeted cleanup cases, but it also underscores why the pre-deletion review needs to be exact.
Ultimately, Microsoft Purview’s planned OneDrive and SharePoint hard-delete option is a powerful answer to a real compliance and security problem: some data must be removed now, not merely marked for eventual disposal. But the feature’s value will depend on how carefully organizations resist treating it as a convenience tool. With simulations, independent approvals, narrowly scoped queries, durable audit evidence, and legal oversight, hard delete can become a responsible final measure. Without those controls, it risks turning a sophisticated compliance platform into a fast route to irreversible data loss.

---

References​

1. Primary source: Microsoft 365 Roadmap
   Published: 2026-07-28T22:43:45.1902826Z
   
   

   Microsoft 365 Roadmap | Microsoft 365

   The Microsoft 365 Roadmap lists updates that are currently planned for applicable subscribers. Check here for more information on the status of new features and updates.

   www.microsoft.com
2. Related coverage: learn.microsoft.com
   
   

   Learn about retention for SharePoint and OneDrive | Microsoft Learn

   Learn how Microsoft 365 retention works for SharePoint and OneDrive, using retention policies and retention labels to manage the automatic retention or deletion of data for your organization.

   learn.microsoft.com