In one Orchestry customer's tenant, 92% of the company's "Anyone" sharing links were found in OneDrives, not SharePoint. Yet two of Microsoft's oversharing controls stop at the OneDrive boundary: site access reviews don't support OneDrive accounts, and Restricted Content Discovery can't be applied to OneDrive sites.
The best OneDrive governance tools close that gap in two ways. They show you every OneDrive in the tenant at once, and they act on what they find: cleaning up sharing links, surfacing drives whose owner has left, and bringing the person who owns the content into the review.
Orchestry, ShareGate Protect, CoreView, Rencore, and Syskit Point all cover OneDrive to some degree. They differ in how far past the inventory each one goes.
Microsoft's own stack is the baseline for every one of them, and the rules it enforces changed in 2026. Unlicensed OneDrive accounts now sit on a 365-day nonpayment clock, which makes knowing who owns each drive a cost question as well as a security one.
In this article:
Most Microsoft 365 governance tools list OneDrive among the workloads they cover. The separation shows up after the inventory loads. Five capabilities decide whether a tool governs OneDrive or only reports on it:
If you're still building the case for OneDrive governance itself, start with how OneDrive governance works at scale.
You set the org-wide OneDrive external sharing level in the SharePoint admin center, and the OneDrive setting can be more restrictive than the SharePoint setting, but not more permissive. If you allow Anyone links, you can require them to expire within a set number of days or limit them to view-only.
Those settings shape new sharing. They don't audit the links already out there, and Anyone links carry a documented limit: with them, you can't track who has access to shared items or who opened them. Microsoft's data access governance sharing-links report shows where people created the most new sharing links in the last 28 days, so older links need another way in.
OneDrive is where the backlog tends to sit, and native reporting doesn't show it to you drive by drive. Orchestry's sharing links reporting lists every link created from each OneDrive, and admins can delete links one at a time or in bulk from that account's Sharing Links tab.
Orchestry OneDrive Details Sharing Links tab showing link types, insights such as anonymous and guest access, and bulk smart actions
Unlicensed OneDrive accounts are automatically put into read-only mode after 60 unlicensed days and archived after 93. Those are default timings: from October 2026, tenants that enable Standard storage can stretch the archive point anywhere from 93 to 3,650 days, with the account going read-only 33 days before archive.
As of July 1, 2026, accounts that stay unlicensed and unpaid are also subject to a cumulative 365-day nonpayment clock, and for accounts already in that state on July 1, 2026, deletion risk begins no earlier than July 1, 2027. The same timeline shows the account is no longer available in eDiscovery from day 275.
For compliance teams, the retention detail matters most. Microsoft says that if billing isn't enabled and the account remains unpaid, you shouldn't rely on retention or legal hold settings alone to preserve that content indefinitely.
During 2026, Microsoft waives the reactivation fee when Standard storage is enabled; otherwise reactivating an archived account through billing costs $0.60 per GB for that account (relicensing the user reactivates it free), and from that month on, $0.05 per GB per month applies to all unlicensed accounts past 93 days. Unlicensed accounts can't draw on unused SharePoint storage quota, and these changes don't apply to EDU, GCC, or DoD customers.
Orchestry OneDrive Reports filtered to unlicensed accounts
Natively, the SharePoint admin center's OneDrive accounts report lists unlicensed accounts with a reason: no owner, owner deleted from Entra ID, license removed by admin, or duplicate account. A governance tool earns its place here by putting license status next to ownership, sharing, and activity, so you can decide which drives to relicense, move, or let go before the clock decides for you. Orchestry's OneDrive reporting includes license status alongside activity, storage, sharing links, and an aggregated risk rating.
By default, when a user is deleted, the user's manager is automatically given access to the user's OneDrive. If access delegation is off, or no manager or secondary owner is set, no one gets automatic access when the user is deleted. The default retention period is 30 days, and you can set it anywhere from 30 through 3,650 days.
Two clocks run on different triggers. The retention cleanup begins only when the account is deleted from Microsoft Entra ID; removing the user's license doesn't start it.
The unlicensed-account clock, though, begins on the date the license is removed or the user is deleted. We walk through what happens to a OneDrive when someone leaves step by step in a separate guide.
For tool selection, the question is whether a platform surfaces orphaned drives before either deadline arrives. Orchestry flags inactive and unlicensed OneDrives across the tenant, so drives whose owner lost a license show up alongside their sharing and storage.
For most subscription plans, the default OneDrive storage limit is 1 TB, and depending on your plan and number of licensed users, you can raise it to 5 TB. Lowering it has a side effect worth planning for: if you decrease the storage limit and a user is over the new limit, their OneDrive becomes read-only.
OneDrive storage management at scale means knowing which drives are growing and why before you touch a quota. We've covered how SharePoint and OneDrive storage turns into a cost surprise. Orchestry's OneDrive reviews, for example, can fire when a drive reaches a set percentage of its quota and ask the owner to consent to version-history cleanup.
The table maps each tool against the five criteria, based on each vendor's product documentation and published pages as of September 2026. "Not found" means we searched the vendor's help center, documentation, and product pages without finding the capability for OneDrive; it may still exist. Capabilities shift release to release, so confirm anything that decides your shortlist in a demo.
| Capability | Orchestry | Microsoft native | ShareGate Protect | CoreView | Rencore | Syskit Point |
|---|---|---|---|---|---|---|
| Tenant-wide OneDrive visibility | ✓ | Partial (SAM) | ✓ | Partial (active OneDrives) | ✓ | ✓ |
| Sharing-link inventory and cleanup | ✓ | Partial | ✓ | Partial | ✓ (automated) | ✓ |
| Orphaned, inactive, and unlicensed drives | ✓ | Unlicensed report | Orphaned and inactive | Unlicensed | Orphaned | Inactive |
| Search and AI exposure for OneDrive | ✓ | Partial | Partial | Not found | Partial | Partial |
| Owner and user involvement | ✓ | Not for OneDrive | Not for OneDrive | Partial | Partial | ✓ |
Orchestry brings personal drives under the same standard of governance it applies to Teams and SharePoint. Orchestry's OneDrive management, part of the Enterprise plan, reports on OneDrive activity, storage, sharing links, license status, and an aggregated risk rating, and it detects orphaned and inactive drives across the tenant.
Orchestry OneDrive Review configuration with sharing-link smart actions for end users
The part that changes the workload is who does the cleanup. OneDrive review policies send each user a task that can include showing or hiding their content from Microsoft 365 search and Copilot, consenting to version-history cleanup, and clearing risky sharing links. Reviews run on a recurring schedule you set between 30 and 1,200 days, or trigger when a drive reaches a percentage of its quota. One customer described this "ask first, enforce later" approach to OneDrive cleanup as critical for meeting new Canadian federal compliance standards.
My OneDrive tab in Orchestry showing a user's own OneDrive insights
End users get a My OneDrive tab in Orchestry, surfaced through Microsoft Teams, where they can see their own OneDrive insights and delete their own sharing links. Two scope notes: Orchestry doesn't restrict or limit OneDrive use, and admins see only file names in sharing-link reports, not file content.
Microsoft's stack covers a lot of OneDrive ground on its own. The admin centers handle org-wide and per-user sharing levels, the unlicensed OneDrive accounts report, and deleted-user retention.
SAM adds data access governance reports across OneDrive sites and OneDrive site access restrictions, which lets you assign up to 10 security or Microsoft 365 groups to a OneDrive, managed through PowerShell. Purview retention policies and labels take precedence over the standard OneDrive deletion process, though Microsoft is clear that unpaid unlicensed accounts can be deleted regardless.
The gaps are specific. Site access reviews, SAM's owner-review workflow, support only SharePoint sites, and Restricted Content Discovery can't be applied to OneDrive. Purview retention policies can now archive inactive OneDrive files out of Copilot's reach, but that's an age-based rule, not a decision by the person who owns the drive.
ShareGate comes to governance from migration and Protect carries that tenant-wide lens forward. It gives you one view of who has access to what across Teams, SharePoint, OneDrive, and Entra ID, lets you delete sharing links at scale, and crawls the tenant every 24 hours. Its cost insights identify OneDrives with no active owner and show the storage each one consumes, and its OneDrive reports filter by last activity and by counts of Anyone and external links.
Protect's policies run once a day against OneDrives and sharing links: OneDrive policies can delete matched drives or set and trim version history, and sharing-link policies delete matched links automatically. Owner involvement is where OneDrive falls outside its reach for now.
ShareGate's delegated reviews route decisions to owners of Microsoft 365 Groups and SharePoint sites, and the documentation says OneDrive isn't supported at launch. For Copilot, ShareGate notes that sensitivity labels are managed in Microsoft Purview, outside Protect.
CoreView approaches OneDrive from the tenant-management side. Its OneDrive use-case page centers on unlicensed accounts: visibility into unlicensed OneDrives, how files in them are being accessed, automation to manage OneDrive accounts, and the ability to detect and fix external sharing in licensed and unlicensed OneDrives. Its Unlicensed OneDrive Owners report covers accounts that became unlicensed through license removal or user deletion, so departed users' drives land there.
For owner input, CoreView's Access Reviews add-on includes a OneDrive ownership template, with reviewers drawn from the people who manage or own the selected resources. Its newer Control for SharePoint add-on targets file-level SharePoint access; we didn't find OneDrive coverage documented for it.
The broader platform secures configuration, identity, and access across Exchange Online, Teams, SharePoint, OneDrive, Intune, and Entra ID, which makes it a natural fit if you're already buying for tenant hardening or delegated administration. We didn't find OneDrive-specific Search or Copilot exposure controls in its documentation.
Rencore frames OneDrive inside a policy engine that spans SharePoint and OneDrive together. Its SharePoint and OneDrive governance page describes continuous discovery of sites, users, and files, and its OneDrive policy library includes a built-in check that finds OneDrive accounts linked to disabled user accounts so they can be reassigned or deprovisioned. Another built-in policy flags OneDrive files older than five years, which Rencore ties to inaccurate Copilot responses.
Remediation and owner contact run through automation. Rencore's OneDrive automation actions include removing all sharing from a file, and its OneDrive automations email owners monthly about files shared externally and warn them once a drive passes 90% of its storage limit.
Its OneDrive file inventory records the sensitivity label on each file. We didn't find a formal OneDrive review in its documentation.
Syskit Point leans toward inventory, investigation, and owner review. Its inventory includes OneDrive alongside inactive resources and anonymous links, and its Site Permissions Changes report shows how the security of OneDrive content changed, when, and by whom. Syskit Point Cloud keeps audit data for one year by default, and alerts can flag oversharing or suspicious external access as it happens.
Workspace Review is where Syskit overlaps most with Orchestry: admins can name a OneDrive's primary admin or owner as the reviewer, and the review's sharing step lets reviewers remove expired, unused, or Anyone links. Its Sharing Links report spans multiple workspaces, OneDrive included, with a remove action, and its risky-workspace checks flag OneDrives holding sensitive files shared with anyone or inactive for more than 90 days.
One gap for offboarding: Syskit's orphaned-users check doesn't apply to OneDrive, and its orphaned-users check skips OneDrives whose primary admin is blocked or deleted, treating that as expected during offboarding.
Match the tool to the problem that put OneDrive on your list:
Storage is often the second reason OneDrive lands on the agenda; this series also compares governance tools for storage cost reduction. The tool that fits is the one that reaches every drive and connects its sharing, ownership, license status, and Copilot visibility to someone who can act on it.
Partly. SAM's data access governance reports include a permissions snapshot across all SharePoint and OneDrive sites, and SAM's site access restriction can limit a OneDrive to up to 10 groups. Site access reviews support only SharePoint sites, and Restricted Content Discovery isn't supported for OneDrive, so owner review and Copilot discovery controls for OneDrive need another route.
Removing a license starts Microsoft's unlicensed-account timeline: by default, the OneDrive goes read-only after 60 unlicensed days, is archived after 93, and, if it stays unpaid, faces deletion risk after 365 cumulative unpaid days. It doesn't start the separate deleted-user retention cleanup, which begins only when the account is deleted from Microsoft Entra ID.
Yes, if the person asking has access to it. Copilot only surfaces organizational data that the individual user has at least view permission to, so a OneDrive file shared broadly is reachable through Copilot by everyone who has access to it. Tightening OneDrive sharing links is how you shrink that reach.
Not always. Microsoft's admin centers and SAM give you sharing controls, unlicensed-account reporting, OneDrive permission reports, and PowerShell-driven access restriction. A third-party tool earns its place when you need every OneDrive reviewed on a schedule, bulk sharing-link cleanup, and owners or users doing part of the work, across more drives than IT can check by hand.
If you're comparing the best OneDrive governance tools, it's worth seeing how Orchestry puts every OneDrive, and the person who owns it, into one review cycle. Book a 30-minute walkthrough in your own tenant.