Microsoft is cracking down on unlicensed OneDrive accounts, saying it will archive them after 90 days, in the interest of cybersecurity.

In an online document, Microsoft says unlicensed accounts within an organization—while common—pose a significant security risk.

As an IT administrator, you might encounter situations where some of your users have unmanaged and unlicensed OneDrive accounts within your organization. Unlicensed OneDrive accounts can pose security and compliance risks, as well as create confusion and duplication of files.

As a result, the company says such accounts will be archived and become inaccessible, beginning in early 2025.

Beginning January 27, 2025, any OneDrive user account that has been unlicensed for longer than 90 days becomes inaccessible to admins and end users. The unlicensed account is automatically archived, viewable via admin tools, but remains inaccessible until administrators take action on them.”

Unfortunately, IT admins may not know how to properly track unlicensed OneDrive account, since they’re not associated with a valid account by default. Unlicensed accounts can also appear for a number of reasons, including an expired license, or an account that was never assigned a license.

Microsoft does provide a way for admins to identify unlicensed accounts so they can take the necessary steps before the deadline.

You can identify unlicensed OneDrive accounts using the SharePoint admin center to generate reports on unlicensed accounts. The following steps show how to use the SharePoint admin center to generate a report of unlicensed OneDrive accounts:

• Sign in to the SharePoint admin center with your work or school account.
• Go to Reports and select User reports.
• Under OneDrive usage, select Unlicensed users.
• You can download the report as a CSV file.
• Starting January 2025, an interactive UI will be available. You can select a username to view the details.

The report shows the username, email address, account type, and last activity date of each unlicensed OneDrive account.

Once unlicensed accounts have been identified, a license can be assigned to them, they can be deleted, or they can be proactively archived before the deadline.