OneDrive for business - IT security check

[yasothadevi]

Hi,

   From the IT Security perspective, if IT Security team needs to perform below on OneDrive data what are the options?

1. Hold the data in user's OneDrive due to suspecting data leak or information leak

2. Retrieving the data deleted from user's Recycle Bin and second level Recycle Bin from OneDrive site

3. Stopping user from clearing Recycle Bin.

Is it possible to perform above? If possible, still the user will be notified?

Regards,

YasothaDevi

[#2 · Accepted solution]

Hi, have a look at retention policies, which can be applied to OneDrive 

https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies

"Comply proactively with industry regulations and internal policies that require you to retain content for a minimum period of time. Retaining content so that it can't be permanently deleted before the end of the retention period.  When content is subject to a retention policy, people can continue to edit and work with the content as if nothing's changed because the content is retained in place, in its original location. But if someone edits or deletes content that's subject to the policy, a copy is saved to a secure location where it's retained while the policy is in effect."

There is also eDiscovery hold:

https://docs.microsoft.com/en-gb/microsoft-365/compliance/ediscovery-cases

"You can use an eDiscovery case to create holds to preserve content that might be relevant to the case. You can place a hold on the mailboxes and OneDrive for Business sites of people who are custodians in the case. When you place content locations on hold, content is held until you remove the hold from the content location or until you delete the hold."

[#3]

Agree here, retention policie are the way to go