When an employee leaves the organization, goes on extended leave, or becomes the subject of an internal investigation, securing their business data becomes a priority. OneDrive for Business often contains important corporate documents, making it essential for administrators to quickly control access when required.
Instead of deleting files or removing the OneDrive entirely, Microsoft 365 allows administrators to change the site’s lock state. You can make the OneDrive read-only so files can still be viewed but not modified, completely block access to the site, or restore normal access when the restriction is no longer needed.
In this guide, we will walk you through two efficient ways to change a user’s OneDrive lock state.
What are OneDrive Lock States
Since OneDrive for Business is built on SharePoint Online, every user’s OneDrive is actually a personal SharePoint site collection. SharePoint allows administrators to configure three different lock states for these sites:
- Unlock restores normal read and write access to the OneDrive.
- ReadOnly allows users to open and download existing files but prevents uploading, editing, renaming, or deleting content.
- NoAccess blocks access to the entire OneDrive site. Users attempting to access the site will receive an access denied error until the site is unlocked again.
These lock states are particularly useful during employee offboarding, temporary leave, investigations, or whenever corporate data needs to be protected without deleting it.
1. Restrict OneDrive Access via PowerShell
Because OneDrive sites are SharePoint Online site collections, administrators can manage their lock state using the SharePoint Online Management Shell.
Prerequisites: Before running the commands, ensure you have downloaded and installed the latest SharePoint Online Management Shell. Once installed, open PowerShell and establish an administrative connection.
Set OneDrive to Read-Only Mode
This mode blocks users from uploading, editing, or deleting files, but allows them to view and download existing content.
#Lock the specific user's OneDrive to Read-Only
Set-SPOSite -Identity "<SiteURL>" -LockState "ReadOnly" Set OneDrive to No-Access Mode
This completely blocks the user from reaching the OneDrive site, throwing a 403 Forbidden error if they attempt to access it.
#Completely block access to the specific user's OneDrive
Set-SPOSite -Identity "<SiteURL>" -LockState "NoAccess"Revert OneDrive to Normal Access
If the restriction was temporary (such as a medical leave), you can easily restore standard read and write capabilities by unlocking the site.
#Unlock the site to restore standard access
Set-SPOSite -Identity "<SiteURL>" -LockState "Unlock"Note: Don’t forget to replace <SiteURL> with the values for your own Microsoft 365 tenant.
How to Find a User’s OneDrive URL
If you do not know the precise personal URL format for the target user, get a comprehensive list of all active user OneDrive sites and their current lock statuses across your tenant.
#List all user OneDrive locations
Get-SPOSite -IncludePersonalSite $true -Limit All | Select-Object Url, LockState 2. Restrict OneDrive Access via EasyEntra
If you prefer avoiding complex command-line scripts or want a faster administrative workflow, you can easily control a user’s OneDrive site lock state directly inside the EasyEntra portal.
Locking a OneDrive site through the UI helps protect data during investigations, employee offboarding, leaves of absence, or other situations where access needs to be restricted temporarily or permanently.
To configure the lock state for OneDrive in EasyEntra, follow these simple steps:
- Open User Properties for the target user.
- Select the OneDrive tab.
- In the Lock state dropdown list, select your desired lock state configuration (Unlock, ReadOnly, or NoAccess).
- Click OK to apply the settings instantly.
With EasyEntra, there is no need to manually retrieve the user’s OneDrive URL or remember SharePoint PowerShell syntax. Everything can be managed directly from the user’s properties, making the process faster and reducing the chance of administrative errors!
