OneDrive now deletes data 12 months after a license is removed, holds and all
Day 1: a Microsoft 365 license is pulled. Day 60: the account goes read-only. Twelve months later the files are gone, and a retention policy or legal hold won't save them unless someone restores the billing first.
From early July 2026, Microsoft starts a deletion countdown on any OneDrive account whose license is removed. Read-only at 60 days, permanent deletion at 12 months, and crucially, an active retention policy or legal hold does not stop it unless licensing is restored first.
A commenter cut through the much-mocked, AI-sounding source blog to the official Microsoft notice, while others argued this was always how unlicensed accounts worked and the only real news is the explicit clock.
A clickbait title, an AI-slop blog, and a real policy change underneath
The post that surfaced in the thread carries an alarming title about OneDrive data having an 'expiry date', and much of the thread spent its energy mocking the blog's writing as obvious LLM filler. But a commenter pointed past the framing to the substance, linking the official Microsoft message-center notice (MC1381110) that the blog was clumsily summarizing.

The actual policy: a 12-month clock on unlicensed accounts
Stripped of the slop, the change is concrete and dated. Starting early July 2026, when a Microsoft 365 user license is removed (the person leaves, or the seat is cut), Microsoft starts a deletion timer on that account's OneDrive:
- Day 1 — license removed or user deleted: the account becomes unlicensed and the retention countdown begins.
- Day 60 — the account goes read-only: no more edits.
- 12 months — the data is permanently deleted.
The sharpest detail, flagged by a high-karma commenter quoting the notice directly, is the one most likely to burn organizations:
"Data can still be deleted even if a retention policy or legal hold is in place, unless licensing or billing is restored first. Do not rely on holds alone to protect unlicensed data." — a commenter quoting the Microsoft notice
So a legal hold — the thing companies trust to preserve data — does not survive an unlicensed account on its own.
'This was always the case' vs. 'this is data theft'
The thread split hard on whether this is alarming or obvious. The pragmatist camp argued unlicensed cloud storage was never going to live forever:
"if you spend 12 months without realizing you might need the data of someone who left then I think that's on you" — a top-karma commenter
A commenter also noted Microsoft's own mitigation — by default a departed user's manager inherits access to their OneDrive — which should give an org time to pull what it needs. Others were far less forgiving, sharing first-hand losses:
"They locked me out without any explanation … ended my subscription and I lost valuable photos forever. Stay away from it." — a full-stack developer who lost photos
And a state-government developer pointed out the trap that makes 'audit your licenses' harder than it sounds: enterprise terms shift constantly.
"the vendor changes the terms and the customer never notices … 'oh, that used to be part of your license, but now it isn't'." — a software developer at a state agency
Whose data is it anyway
A recurring correction in the thread is worth keeping: this is not about your personal photos vanishing tomorrow. As one commenter put it, the title is 'infuriatingly click-bait' — it targets organizational OneDrive accounts that have gone unlicensed, typically because someone left. The genuinely new thing is not deletion-of-abandoned-data — that was always implied — but the explicit, documented timeline and the line that holds and retention policies won't override billing. If you administer a tenant, the takeaway is narrow and practical: a removed seat is now a deletion countdown, and a legal hold is not a backup.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Massachusetts votes 146-0 to ban selling precise location data, but 'sale' is the catch
The Massachusetts House passed a privacy bill unanimously that bars selling anyone's precise location, residents and visitors alike. An ex-Googler in the thread points out the word doing the work is 'sale', and the data is already gathered.