Microsoft Purview Hard Delete Will Bypass OneDrive, SharePoint Bins

Microsoft is preparing to give compliance teams a much sharper—and far more consequential—deletion tool: hard delete for OneDrive and SharePoint content through Microsoft Purview Data Lifecycle Management’s Priority cleanup workflows. Listed as Microsoft 365 Roadmap ID 558343, the capability is in development, with Preview targeted for July 2026 and General Availability targeted for September 2026 for worldwide multi-tenant customers, across both Preview and General Availability release rings. As with all roadmap entries, those dates remain estimates and can change. Microsoft’s roadmap frames the feature as a way to configure a Priority cleanup policy so selected files bypass the OneDrive and SharePoint recycle bins entirely.
That sounds like a narrow checkbox change. It is not.
For Microsoft 365 administrators, the feature marks a material change in the lifecycle of data governed by retention policies, retention labels, and eDiscovery holds. Today, Purview Priority cleanup can override those controls for qualifying OneDrive and SharePoint files, but the resulting files are generally sent to the second-stage Recycle Bin, preserving the platform’s established recovery window. The forthcoming hard-delete option is designed to skip that safety net for specifically scoped content, enabling permanent deletion through a workflow that remains controlled by approvals, simulations, permissions, and audit trails.
The result is a more practical tool for data spillage, urgent privacy remediation, regulatory deletion requirements, and high-volume storage cleanup. It is also a capability that administrators should treat as an exceptional process—not as a faster version of ordinary retention.

---

Overview: What Microsoft Purview Is Changing​

Microsoft Purview Data Lifecycle Management already enables organizations to retain, review, and delete information across Microsoft 365 workloads. In SharePoint and OneDrive, retention policies and retention labels can preserve files even after users edit or delete them, often by storing compliance copies in the hidden Preservation Hold library. Microsoft’s retention documentation explains that these libraries are system locations intended to preserve content automatically for compliance purposes, rather than places administrators should manipulate directly.
The normal design is intentionally conservative. A file that reaches the end of its retention period does not necessarily vanish immediately. Depending on the policy and the state of the file, it can move through the first-stage and second-stage recycle bins before permanent deletion. Microsoft says the 93-day recycle-bin retention period spans both stages, rather than providing 93 days in each one. Microsoft’s SharePoint and OneDrive retention guidance also notes that the second-stage Recycle Bin is accessible to site collection administrators, even though ordinary users do not see it.
That behavior protects organizations from a disastrous but common problem: a retention configuration that is too broad, too aggressive, or simply wrong. It provides a period in which administrators can spot a bad policy outcome and restore material before it becomes unrecoverable.
The roadmap item changes the final step for selected Priority cleanup policies. Rather than moving matched content into the recycle-bin path, compliance teams will be able to choose a hard delete configuration that permanently removes files from scoped OneDrive and SharePoint locations.
That is the headline. The operational reality is more nuanced.

Priority Cleanup Is Already an Override Mechanism​

Priority cleanup is not a normal user-delete process. Microsoft describes it as a Purview feature that can override existing retention settings and eDiscovery holds to delete content in OneDrive and SharePoint. Microsoft’s Priority cleanup documentation says the feature is intended for circumstances including security or privacy incidents, regulatory requirements, stale Teams meeting recordings, and retained files that prevent a departed employee’s OneDrive from being deleted.
Under the existing documented workflow, Priority cleanup performs a deliberately governed override. It uses retention-label and auto-apply-policy mechanisms behind the scenes, but administrators do not manually manage those underlying labels. Microsoft notes that the workflow supersedes the ordinary principles of retention, meaning organizations do not have to wait for the longest active retention period to expire before deleting eligible items.
The present difference is the landing zone. Today’s documented SharePoint and OneDrive process moves approved items to the second-stage Recycle Bin, where they continue through the ordinary deletion timetable. The hard-delete option described in Roadmap ID 558343 is meant to remove that last delay.

---

Why the Existing 93-Day Safety Net Exists​

The recycle-bin path is not administrative clutter. It is an intentional recovery control in Microsoft 365’s content lifecycle architecture.
When retention settings apply to content in OneDrive or SharePoint, Microsoft periodically evaluates the files through timer jobs. For retained-and-deleted content, files can be moved into a recycle bin at the end of the retention period, then permanently deleted after the 93-day recycle-bin period elapses. Microsoft’s retention lifecycle guidance emphasizes that content formerly stored in the Preservation Hold library is routed through the second-stage Recycle Bin before final deletion, specifically to reduce the risk of inadvertent data loss.
This is important for several reasons:

• Policy mistakes happen. An incorrectly written query can match far more content than its author expected.
• Metadata is imperfect. A file’s path, file type, owner, modified date, or label may not tell the complete business story.
• Legal context changes. A file may become relevant to an investigation or dispute after a cleanup process begins.
• Human review is not infallible. Even careful approvers can misunderstand scope or overlook a dependency.
• Recovery is often time-sensitive. A recycling period lets teams restore the data after a late discovery without treating every ordinary deletion as a forensic emergency.

The system is conservative by design because deletion has asymmetric consequences. Keeping a stale recording for too long is often inconvenient or costly. Permanently deleting the only copy of material required for a lawsuit, audit, investigation, customer request, or business continuity event can be much worse.
Microsoft’s separate OneDrive lifecycle documentation illustrates the same cautious approach. When an employee account is deleted, the OneDrive cleanup process can retain the account for a configured period before the site moves to the site collection Recycle Bin, where it remains recoverable for 93 days. Microsoft’s OneDrive retention and deletion guide explains that retention policies, retention labels, and eDiscovery holds can supersede that ordinary site-deletion flow.
Priority cleanup already gives organizations a way to override some of those controls. The roadmap feature takes the next step: it allows a separately configured path in which the recycle-bin recovery buffer is not used.

---

The Operational Case for Hard Delete​

A hard-delete option is not an invitation to delete content casually. It is a response to scenarios where not deleting quickly creates its own compliance, legal, security, privacy, or cost problem.

Data Spillage and Sensitive-Data Exposure​

The clearest scenario is data spillage: information placed in the wrong location, made available to the wrong audience, or retained contrary to policy. This might include a document containing credentials, customer data, employee records, regulated information, or material subject to a deletion obligation.
A normal retention policy can be structurally at odds with that outcome. Retention and legal-hold controls exist to preserve evidence and records. But organizations sometimes need to purge an item because continuing to keep it is itself the risk. Priority cleanup gives compliance teams a controlled override mechanism for these exceptional cases. Microsoft’s documentation explicitly identifies security, privacy incidents, and compliance with regulatory requirements as situations where the feature can be needed.
The hard-delete extension matters because sending a problematic file to the recycle bin does not necessarily satisfy a requirement to remove it from recoverable tenant storage. It may still be accessible to authorized administrators during that recovery period. For a true remediation workflow, administrators may require a path that permanently removes the selected file rather than merely making it unavailable to end users.

Teams Recordings, Copilot Recap, and Storage Pressure​

Microsoft also identifies stale Teams meeting recordings and transcripts as a central OneDrive and SharePoint use case for Priority cleanup. Most meeting recordings and transcripts are stored in OneDrive, while channel meeting recordings are stored in SharePoint. Microsoft’s Priority cleanup guidance says these files can be large and may have limited business value after one to three months, especially when they are retained longer than needed because of a general policy.
This is increasingly relevant in organizations using Teams recordings, transcripts, and AI-generated meeting experiences at scale. Content that once appeared in small quantities can grow quickly when every recurring meeting produces video, audio, transcript, chat-adjacent artifacts, and collaborative files.
A continuing Priority cleanup policy can target those recurring file categories using a query. Microsoft provides ProgID:Media AND ProgID:Meeting as an example query for Teams recordings and transcripts. Its policy configuration guidance also confirms that these query-driven policies use the same search index as eDiscovery content search.
Hard delete could make cleanup more meaningful for storage remediation because the storage is not tied up in recoverable recycle-bin content for another 93 days. However, that benefit should not obscure the wider governance issue: a storage-management objective is rarely sufficient, by itself, to justify permanent removal of potentially relevant records.

Departed Employees and Preservation Hold Libraries​

A second focused use case involves former employees’ OneDrive accounts. If the account holds content preserved under an unexpired retention rule, the OneDrive site may remain undeletable. This can leave organizations storing data tied to departed staff for far longer than their operational lifecycle would otherwise require.
Microsoft says Priority cleanup can delete retained items from a former employee’s Preservation Hold library, allowing the organization to remove the corresponding OneDrive site and reclaim the storage. Microsoft’s official documentation recommends creating that kind of policy after the user has left and the OneDrive account is blocked from deletion.
Hard delete potentially makes that use case more final. Instead of starting a further 93-day recycle-bin countdown after approval, the organization can remove specific approved files through the hard-delete workflow. Yet this is also one of the scenarios where an organization should be most cautious: former employee data is frequently relevant to employment disputes, intellectual-property questions, contract issues, and internal investigations.

---

How the Guardrails Work—and Why They Matter​

Microsoft has designed Priority cleanup to be restrictive even before hard delete is introduced. Those controls become more important when deletion bypasses the recycle bins.

Simulation Is Mandatory for OneDrive and SharePoint​

For SharePoint and OneDrive Priority cleanup policies, simulation is required before the policy can run. The simulation lets administrators inspect sample results, refine the query, and validate scope before approval. Microsoft’s implementation guidance says a new simulation is required not only during initial setup but also after policy changes other than an edit to the description.
This is one of the most valuable safeguards in the workflow. Administrators should treat it as a substantive review stage, not a procedural box to tick.
A robust simulation review should validate:

• File names, paths, owners, and associated sites.
• Search terms and exclusions.
• File extensions and content types.
• The expected relationship between the query and the stated business objective.
• Whether samples include documents that should instead be preserved.
• Whether multiple sites or OneDrive accounts have been unintentionally swept into scope.
• Whether the policy’s intended retention override is legally approved.

The key technical concern is query precision. Priority cleanup uses Keyword Query Language, or KeyQL, with logical operators such as AND, OR, and NOT. Microsoft’s policy setup documentation confirms that administrators can use those controls to target specific files. A vague term, a broad wildcard, or a missing exclusion can turn a narrowly justified cleanup into a tenant-wide deletion incident.

The Two-Person Rule Is a Real Separation of Duties​

Each item subject to Priority cleanup requires approval from at least one person other than the policy creator. Microsoft requires a Priority Cleanup Admin approval for all policies, while items also under eDiscovery holds require eDiscovery administrator approval. Microsoft’s role and approver documentation makes clear that approvers must be individual users rather than mail-enabled security groups.
The process goes further. The last person to edit a policy cannot also turn it on. Microsoft’s guidance recommends that one priority admin perform edits after creation and that another admin turn on the policy after reviewing the simulation results.
That restriction helps prevent one powerful account from defining, validating, and executing a high-impact deletion workflow without independent review. It is a small design choice with large governance value.
For hard delete, organizations should reinforce Microsoft’s baseline with internal controls:

1. Require written business justification for every hard-delete policy.
2. Require legal or privacy approval for security incidents and data-subject deletion requests.
3. Use a separate operational approver who understands the target workload.
4. Export the pending-cleanup view before approval.
5. Preserve the policy query, simulation evidence, approval decision, and cleanup ID in a case record.
6. Establish a change window and stakeholder notification process for broad or recurring policies.

Auditing Must Become Part of the Workflow​

Microsoft requires auditing to be enabled at least one day before the first Priority cleanup policy runs. Microsoft’s Priority cleanup prerequisites also state that auditing is necessary to view simulation results.
This is especially significant because the audit log is the best durable record that a deletion was requested, approved, and executed through the appropriate workflow. Microsoft documents audit events including PriorityCleanupTagApplied and PriorityCleanupFileRecycled for OneDrive and SharePoint cleanup actions. Microsoft’s Priority cleanup monitoring guidance advises searching audit records with the policy’s cleanup ID.
Microsoft’s audit activity catalog also lists PriorityCleanupFileDeleted as the event for a file permanently deleted by a Priority cleanup policy in OneDrive or SharePoint Online. Microsoft’s audit-log activity reference provides a useful indication of the telemetry organizations should expect to review as hard-delete capability reaches tenants.
For compliance teams, an audit event is not merely a troubleshooting tool. It is evidence of authorization, process execution, and accountability. That record should be retained in line with the organization’s own governance obligations.

---

Important Limits: What Hard Delete Does Not Mean​

The phrase hard delete can create an impression of unlimited administrative power. Priority cleanup remains bounded by platform rules and content states.
Microsoft says Priority cleanup cannot be used for items marked as a record or regulatory record. Microsoft’s documented exceptions are important because those designations exist specifically to place stricter controls around content that must not be casually changed or deleted.
Likewise, deleting the original item does not necessarily remove all copies everywhere. Content might already have been collected into an eDiscovery review set, where Priority cleanup cannot delete it. Microsoft explains that such content is automatically removed only when the entire eDiscovery case is deleted by an eDiscovery administrator. Microsoft’s Priority cleanup limitations underscore that a cleanup decision must account for the full information estate, not just the original file location.
There are also operational limitations. If an approver decides an item should not be deleted, the required action is to apply an existing retention label. Microsoft does not offer automatic approval after a waiting period, approver nomination, or customizable email notification in the SharePoint and OneDrive Priority cleanup process. Microsoft’s feature limitations make clear that the workflow is intentionally hands-on.
That manual friction is a feature, not a flaw. Permanent deletion should be hard to operationalize.

---

The Biggest Risk: Treating Compliance Cleanup as Storage Cleanup​

The most tempting use of hard delete will be storage reclamation. Large recordings, duplicate working files, former employee sites, and old project artifacts can all create pressure to remove data quickly.
But storage pressure is a poor substitute for records policy.
If content has a defensible retention requirement, a hard-delete workflow should not be used simply because the content is expensive to store or inconvenient to manage. The first task is to determine whether the organization’s retention architecture is overly broad. A policy intended to retain financial records, for example, should not unintentionally keep every informal meeting recording for years.
Priority cleanup is best understood as an escape hatch for exceptions. It is appropriate when a valid and documented reason exists to override normal retention or hold behavior. It is not a replacement for carefully scoped retention labels, sustainable disposition schedules, SharePoint storage planning, or defensible information governance.
There is also a practical timing issue. Microsoft says that after a Priority cleanup policy is turned on, it can take up to seven days to reach an Enabled (Success) status, and items can take up to seven days to be deleted after approval in the standard workflow. Microsoft’s operational documentation shows that Priority cleanup is a governed lifecycle operation, not an instant-response button.
That means organizations should not wait until a crisis reaches its peak to understand the process. Roles, audit configuration, approver assignments, query patterns, escalation paths, and legal review standards should be prepared in advance.

---

A Practical Rollout Strategy for Microsoft 365 Administrators​

Organizations expecting the hard-delete option should prepare now, before it reaches General Availability.

1. Classify the Intended Use Cases​

Document the situations that can justify hard delete. Keep the list narrow and approved by compliance, legal, security, privacy, and records-management stakeholders.
Likely categories include:

• Confirmed sensitive-data spillage.
• Regulatory deletion mandates with a defined scope.
• Privacy remediation where recoverable retention conflicts with a documented obligation.
• Cleanup of content that was inadvertently preserved by a misapplied policy.
• Specifically approved disposal of stale high-volume meeting recordings.
• OneDrive remediation after employee departure, once legal and business review is complete.

2. Validate Roles and Separation of Duties​

Confirm that the right people have the Priority Cleanup Admin, Content Explorer, retention management, and eDiscovery roles required for their portion of the process. Microsoft’s permissions table shows that eDiscovery approvers need several distinct roles, including Search And Purge, Hold, Review, and Disposition Management.
Do not assign these roles reactively during an incident. Role propagation, internal approvals, and access reviews create delay precisely when teams want to act quickly.

3. Build and Test Query Patterns​

Create tested KeyQL patterns for recurring scenarios. Microsoft’s examples for meeting artifacts and Preservation Hold library content provide useful starting points, but every tenant’s file structures and naming conventions differ. Microsoft’s query examples should be adapted, not copied blindly.
Maintain a library of approved query templates with documented exclusions and sample validation records.

4. Make Simulation Review Meaningful​

Require reviewers to inspect samples at the item level. Confirm that the scope contains only the expected content and that no material subject to a separate business, contractual, regulatory, or litigation need is included.
For hard-delete policies, the simulation record should be preserved alongside the approval record. Once the recycle-bin stage is bypassed, that evidence will matter far more than it did during recoverable cleanup.

5. Monitor the Audit Trail Through Completion​

Capture the cleanup ID, search the audit log, export pending and disposed item views, and confirm final workflow status. Microsoft allows approvers to export information from the Pending cleanups and Disposed items views as CSV files. Microsoft’s approval-process documentation makes that export capability a straightforward way to create operational evidence for case files and post-action review.

---

The Bottom Line​

Microsoft Purview’s planned hard-delete capability for OneDrive and SharePoint Priority cleanup closes a gap that has long existed between overriding retention and permanently erasing specifically approved content. For organizations handling data spillage, privacy incidents, narrowly scoped legal requirements, and persistent storage burdens from obsolete recordings or blocked OneDrive sites, the capability can be highly valuable.
Its value comes precisely from its severity. Bypassing the recycle bins removes the final recovery layer built into SharePoint and OneDrive’s ordinary lifecycle processes. Microsoft’s existing simulation requirement, two-person approval model, separate eDiscovery approval, role constraints, and audit logging provide a strong foundation—but they do not replace disciplined governance.
The best Microsoft 365 tenants will use this feature sparingly, with exact queries, meaningful review, documented approvals, and clear legal authority. In that model, hard delete becomes what it should be: a secure, auditable exception for content that genuinely cannot remain recoverable, rather than a shortcut around careful data lifecycle management.

---

References​

1. Primary source: Microsoft 365 Roadmap
   Published: 2026-07-28T22:43:45.1902826Z
   
   

   Microsoft 365 Roadmap | Microsoft 365

   The Microsoft 365 Roadmap lists updates that are currently planned for applicable subscribers. Check here for more information on the status of new features and updates.

   www.microsoft.com
2. Related coverage: learn.microsoft.com
   
   

   OneDrive retention and deletion - SharePoint in Microsoft 365 | Microsoft Learn

   Learn what happens to a user's OneDrive when the user's Microsoft 365 account for the organization is deleted.

   learn.microsoft.com