SharePoint Online storage optimization
Which terabytes are you paying for that nobody has opened in a year?
In a typical tenant, 30-50% of SharePoint storage sits in sites with no activity in a year, and single forgotten sites hold multiple terabytes - all still billed per GB every month. 1Security ranks every site and OneDrive by size, silence and exposure, so you know exactly which terabytes are safe to reclaim, and cleans them up behind a review window.
The problem
The storage bill grows every month. Nobody knows what is safe to delete.
SharePoint storage only goes one way: projects end, teams dissolve, migrations leave a second copy of everything, leavers keep their OneDrive, and the sites stay. Every GB over the pooled quota is billed, so when the invoice finally hurts, the cleanup question lands on IT - and deleting the wrong site is the kind of mistake everyone remembers.
The numbers are consistently large. It is common to find 30-50% of all storage in sites nobody has opened in a year, a handful of migration and archive sites holding 2-10 TB each, and hundreds of OneDrives of people who left long ago. In bigger tenants that adds up to tens or hundreds of terabytes that could be reclaimed tomorrow.
A list sorted by size is where most cleanups start and stall. Size alone cannot say what is safe: the biggest site might be the finance archive, and a small one might be the only copy of something legal needs. Safe cleanup needs last activity, owners, external users and sensitive files right next to the gigabytes - and 1Security puts them in the same table.
In practice
The cleanup pass that pays for the renewal.
A safe storage reclaim in 1Security, end to end - no scripts, no guessing.
- 01
Sort Sites by storage, then filter to silence
Open Sites, sort by storage descending, then filter to no activity in the last year and no owners. Storage is a first-class column next to last activity, so the top of that list is the cleanup budget nobody was tracking - typically a few dozen sites carrying a large share of the whole tenant.
- 02
Read the risk columns before you archive
The same rows show external users still attached, "anyone" sharing links and sensitive-info counts. A 4 TB archive site with no activity since 2024 and 12 external users is a security fix and a cost fix in one pass - and the sites that still matter are visibly not on the list.
- 03
Stage the cleanup behind a review window
Enable the suggested automation - archive silent sites, remove their external access, reclaim dormant OneDrives - and 1Security stages a proposal per site. 72 hours to review by default, site owners can be asked to confirm, and rejecting a proposal snoozes it. Nothing disappears silently.
- 04
Reclaim the OneDrives and licenses in the same pass
Open Users, filter to no sign-in for 90 days with a license attached: dormant accounts still holding OneDrive storage and paid seats. Storage reclaimed and licenses returned land in one Actions log, so the renewal conversation opens with "we freed 40 TB and 150 seats", not an estimate.
What makes it work
The data that finds risk also finds waste.
Storage optimization is a lifecycle question. It runs on the same site inventory, live counts and staged automations you can read about in depth.
SharePoint Governance Tool
Every site ranked by exposure and abandonment, with storage in GB, last activity and ownership as first-class columns.
Explore SharePoint governance →Microsoft 365 Inventory Tool
The live inventory of every site, channel site and OneDrive - including the duplicates and migration leftovers the official list forgot.
Explore the inventory →Lifecycle & License Reclaim
Dormant accounts, their OneDrives and idle paid seats cleaned in one reviewed flow.
Explore lifecycle →
FAQ
Common questions.
How much storage do tenants typically get back?
Enough to change the renewal. It is common to find 30-50% of storage in sites with no activity in a year, and single migration or archive sites holding several terabytes each. Your own list - sites sorted by size with last activity next to them - is on screen the same day you connect.
How do we avoid deleting something that matters?
Cleanup is staged, not immediate. Automations propose a per-site action behind a 72-hour review window (configurable all the way to manual approval only), site owners can be routed into the review, and a rejection snoozes the proposal. Every executed action is logged with who approved it and when.
Does this need any special Microsoft licensing?
No. Site discovery, storage, activity and exposure columns work from a standard license - the floor is Microsoft 365 Business Basic. Write actions are a separate, opt-in consent.
Can we prove what the cleanup achieved?
Yes. The Actions log records every change with click-through to the exact sites, and Trends track site count, storage and license utilization over time - so the before and after is a chart, not an estimate.
The 1Security platform
SharePoint Storage Optimization is just the beginning
SharePoint Storage Optimization is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- Sensitive dataPersonal data, credentials, financial and health records found by our own classifiers, with a Microsoft second opinion where the client has it.
- Sensitivity labelsLabel coverage and gaps across sites and files, so the protection the client paid for is actually applied.
- Users, groups and lifecycleDormant accounts, guests who never left, groups nested three deep, orphaned owners, admins without MFA. The review that is a spreadsheet everywhere else.
- External domainsEvery outside organization with a foothold in the tenant, its trust posture, its drift, and who it was invited by.
- Email and mailboxesWho can read whose mailbox, forwarding rules, threads with sensitive content, inbound and outbound exposure.
- LicencesWhat is assigned, what is unused, and which bundle an action or feature still needs, so the upgrade you sell is the one the client needs.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
See which terabytes are safe to reclaim.
Connect read-only and get every site ranked by size, silence and exposure the same day. Then stage the cleanup behind a review window - the first pass usually pays for itself.
Or approve the storage invoice again, unread.