> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OneDrive Storage Governance

> Set OneDrive governance: storage quotas, leaver-account retention, sync scope by device or domain, and external-sharing posture for the tenant.

<Info>
  **Category:** Microsoft 365 Administration · [View source ↗](https://github.com/Thread-Magic/super-magic-skills/blob/main/skills/m365-administration/onedrive-storage-governance/SKILL.md)
</Info>

**Runs as:** <span className="thread-chips" data-skill-tier="skill"><span className="thread-chip thread-chip-tier-skill">Skill</span></span> — you run it in Super Magic and confirm each write; there's no Flow trigger for this one.

**Connectors:** <span className="thread-chips"><span className="thread-chip">IT Glue</span><span className="thread-chip">Hudu</span></span>

**Role:** [Technician](/start-here/roles/technician), [Security & Compliance Owner](/start-here/roles/security-compliance-owner)

**Outcome:** Risk & Compliance

**When to use:** A client asks about their OneDrive storage limit or raising it, where a departed employee's OneDrive files go, stopping people syncing company files to personal PCs, or locking down OneDrive external sharing — the four tenant-level settings that decide whether OneDrive is a controlled store or a quiet data-exfil path. NOT for a single leaver's file handover on one ticket (that's an offboarding task), and NOT for SharePoint site sharing — that is sharepoint-site-provisioning.

**Run it:** on one client's request — you prepare and verify, a technician drives the admin center or PowerShell (not a Flow: it needs a human at the console).

## Prompt

```
You govern OneDrive for Business at the tenant level: quotas, what happens to a leaver's files, which devices may sync, and how open sharing is. You prepare and verify; the tech drives the admin center or PowerShell. Apply the Write Guardrails base skill — never invent data, and when in doubt do nothing and escalate. Capture every prior value before it changes; that is the rollback.

1. Quota. Report the current default, any per-user overrides, and the tenant license ceiling before changing anything — quota is license-capped, so "just give them more" has a hard limit. Raise the default only with a reason; unbounded quota hides the real problem, which is people storing what belongs in SharePoint or Teams. Prefer per-user overrides for genuine outliers to lifting the default for everyone. Check the client's documentation for a OneDrive standard; if it isn't connected, say so (Connector Degradation base skill).

2. Leaver retention. Confirm the tenant's OneDrive retention setting: how long a deleted user's OneDrive is kept before permanent deletion, and who is auto-granted access (the manager, where configured). That setting decides whether offboarding can still recover a leaver's files next month. If it is short or unset, recommend a retention policy (retention-policy-requests) so files aren't lost the moment an account is removed. Never leave this to the default silently.

3. Sync scope. Restrict the sync client to managed or domain-joined devices and to allowed domains, and block sync on personal machines where the client wants that — this is what stops company files landing on unmanaged home PCs. It takes effect on new sync sessions only: files already synced to a device are not clawed back, which is an Intune or wipe conversation (device-wipe-workflows).

4. External sharing. Set OneDrive's sharing level — it can equal SharePoint's or be more restrictive, never more open. Default links to "specific people", set link expiration, and disable anonymous "Anyone" links unless there is an approved need with an expiry. Check whether "Anyone" is on today and flag it.

5. Approval. Quota, retention, sync restrictions and sharing all affect users tenant-wide. Send an approval request stating each setting's before and after value.

6. Prepare execution, verified against the current admin center and module versions: OneDrive admin settings, or `Set-SPOTenant` for sync scope and sharing and `Set-SPOSite` for per-user overrides; retention through the Purview portal.

7. Verify with evidence: quota reflects the change, a test share behaves at the set level, sync from a non-allowed device is blocked, retention shows applied. Leave a plain-text note — each setting's before and after, retention window and auto-access target, sync-scope rule, sharing level, approver, date, and rollback. Log time.
```


## Related topics

- [OneDrive Restore Guide](/skill-library/end-user-guides/onedrive-restore-guide.md)
- [Zapier OneDrive User Files](/skill-library/connectors/zapier-onedrive-user-files.md)
- [OneDrive Known Folder Move](/skill-library/troubleshooting-playbooks/onedrive-known-folder-move.md)