A site that "keeps filling up" while users swear they've deleted everything is usually doing exactly what your retention settings asked for: keeping the originals in the Preservation Hold library. In this post I'll explain what goes into that library, how to measure it, what you must not touch, and the safe ways to bring storage back under control.
How it works#
When content in a SharePoint site or OneDrive is subject to retention, SharePoint creates a hidden Preservation Hold library if the site doesn't have one. It's a system location: Microsoft doesn't support editing, deleting or moving the retained files yourself, or changing their labels. You reach that content through compliance tools such as eDiscovery instead. Like any library, it uses the site's storage.
Whether an edit or a delete creates a copy depends on what applies to the item:
| What applies | User edits | User deletes |
|---|---|---|
| Retention policy | Copy created (not for new content on its first edit) | Copy created |
| Standard retention label | No copy | Copy created |
| Label that marks items as records | Copy if unlocked; blocked if locked | Blocked |
| Label that marks regulatory records | Blocked | Blocked |
Three details explain most of the growth:
- Versions. Since July 2022, all versions of a retained file that isn't a record are kept together as one file in the library; versions of records are still copied as separate files. Versioning must be on to retain every version.
- Version limits are paused. For items under a retention policy or an eDiscovery hold, the library's version limits are ignored until the retention period ends or the hold is released: old versions aren't purged and users can't delete them. With retention labels alone, version limits still trim old versions.
- Cleanup is slow by design. A timer job runs every seven days and only evaluates content that has been in the library for more than 30 days, so removal can take up to 37 days. Expired items then go to the second-stage Recycle Bin and are permanently deleted within 93 days, unless another policy or hold still needs them.
Step-by-step#
1. Measure where the storage is#
In the SharePoint admin center › Sites › Active sites, sort by storage used. For a single site, open Site settings › Site collection administration › Storage metrics as a site collection admin; the Preservation Hold library appears with its size next to the other libraries. To list the biggest sites:
Connect-SPOService -Url https://contoso-admin.sharepoint.com
Get-SPOSite -Limit All -IncludePersonalSite $true |
Sort-Object StorageUsageCurrent -Descending |
Select-Object -First 20 Url, StorageUsageCurrentStorageUsageCurrent is in megabytes and covers the whole site; Storage metrics tells you how much of it is the Preservation Hold library.
2. Find out what is holding the content#
In the Microsoft Purview portal, use Policy lookup under Data lifecycle management to see which retention policies apply to the site or user, and check eDiscovery cases for holds on the location. In Security & Compliance PowerShell:
Connect-IPPSSession
Get-RetentionCompliancePolicy -DistributionDetail |
Format-List Name, Enabled, DistributionStatus, SharePointLocation, SharePointLocationException, OneDriveLocation, OneDriveLocationExceptionA policy with All in SharePointLocation or OneDriveLocation covers every site or account unless it's listed as an exception. Note the retention period and action of each policy that matches.
3. Agree what the content actually needs#
Changing retention is a compliance decision, not a storage tweak. Take the numbers from step 1 to the records or legal owner and agree, site by site, whether the current scope and period are required.
4. Apply a safe change#
- Scope the policy better. Exclude sites that don't need retention, or replace an org-wide policy with policies aimed at the sites and accounts that do, for example with adaptive scopes.
- Shorten or change the action where the requirement allows it, such as retain-and-delete instead of retain-forever. A policy with Preservation Lock can't be relaxed this way, by design.
- Release holds that are finished. When a matter closes, remove the eDiscovery hold so the content becomes eligible for cleanup again.
- Add storage or archive. If the content must stay, buy storage or move inactive sites to Microsoft 365 Archive; retention keeps applying to archived sites.
Verify#
Get-RetentionCompliancePolicy -DistributionDetailshows the changed policy withDistributionStatusSuccess, and the site appears (or no longer appears) where you expect.- Policy lookup for the site shows only the policies you agreed on.
- Recheck Storage metrics after about five weeks. Expect the Preservation Hold library to shrink only after the timer job's 30-day minimum and weekly run, and remember that cleaned-up items spend up to 93 days in the second-stage Recycle Bin before they're permanently deleted.
- Keep a monthly report of the largest sites so the next jump is spotted early.
Tips and gotchas#
- Don't "clean" the library by hand. Deleting or moving retained files isn't supported, and tighter version settings don't trim versions that a retention policy or hold is keeping.
- Users see an error if they try to delete a library, list or site that's subject to retention; that's expected, not a fault.
- Labeled files that won't delete stay in place rather than being copied when the records management setting that allows deleting labeled items is off. Find it in the Purview portal under Settings › Solution settings › Records Management › Retention Labels › Deleting content labeled for retention; SharePoint and OneDrive have separate settings.
- Cloud attachments add copies. An auto-apply label policy for cloud attachments stores a labeled copy of each shared file in the Preservation Hold library, usually within an hour of sharing, and a new copy each time a modified file is shared again.
- Retention needs a searchable site. Sites must be indexed for retention settings to apply, and items in a site locked to
NoAccessorReadOnlycan't be deleted. - Departed users. Retained OneDrive content stays, still shared and discoverable, for the full retention period; if the settings include a delete action, it then moves to the site collection recycle bin.
- Mailboxes follow different rules; see retention policies, labels, MRM and litigation hold in Exchange Online. To collect retained content for a matter, see eDiscovery search and export errors.

