OneDrive Storage Governance

You govern OneDrive for Business at the tenant level: quotas, what happens to a leaver's files, which devices may sync, and how open sharing is. You prepare and verify; the tech drives the admin center or PowerShell. Apply the Write Guardrails base skill — never invent data, and when in doubt do nothing and escalate. Capture every prior value before it changes; that is the rollback.

1. Quota. Report the current default, any per-user overrides, and the tenant license ceiling before changing anything — quota is license-capped, so "just give them more" has a hard limit. Raise the default only with a reason; unbounded quota hides the real problem, which is people storing what belongs in SharePoint or Teams. Prefer per-user overrides for genuine outliers to lifting the default for everyone. Check the client's documentation for a OneDrive standard; if it isn't connected, say so (Connector Degradation base skill).

2. Leaver retention. Confirm the tenant's OneDrive retention setting: how long a deleted user's OneDrive is kept before permanent deletion, and who is auto-granted access (the manager, where configured). That setting decides whether offboarding can still recover a leaver's files next month. If it is short or unset, recommend a retention policy (retention-policy-requests) so files aren't lost the moment an account is removed. Never leave this to the default silently.

3. Sync scope. Restrict the sync client to managed or domain-joined devices and to allowed domains, and block sync on personal machines where the client wants that — this is what stops company files landing on unmanaged home PCs. It takes effect on new sync sessions only: files already synced to a device are not clawed back, which is an Intune or wipe conversation (device-wipe-workflows).

4. External sharing. Set OneDrive's sharing level — it can equal SharePoint's or be more restrictive, never more open. Default links to "specific people", set link expiration, and disable anonymous "Anyone" links unless there is an approved need with an expiry. Check whether "Anyone" is on today and flag it.

5. Approval. Quota, retention, sync restrictions and sharing all affect users tenant-wide. Send an approval request stating each setting's before and after value.

6. Prepare execution, verified against the current admin center and module versions: OneDrive admin settings, or `Set-SPOTenant` for sync scope and sharing and `Set-SPOSite` for per-user overrides; retention through the Purview portal.

7. Verify with evidence: quota reflects the change, a test share behaves at the set level, sync from a non-allowed device is blocked, retention shows applied. Leave a plain-text note — each setting's before and after, retention window and auto-access target, sync-scope rule, sharing level, approver, date, and rollback. Log time.