Understanding Data Store Size Discrepancies Compared to Microsoft Admin Center

In DSPM, data store storage size is often lower than the size shown in the Microsoft Admin Center. This discrepancy is expected and results from fundamental differences in how SharePoint and OneDrive calculate storage usage versus how DSPM computes data size for scanning.

• DSPM reports the size of scannable, user-facing content only.
• Microsoft SharePoint and OneDrive storage reports include several additional categories such as older file versions, recycle bin content, retention/hold libraries, and system/hidden folders. Because DSPM cannot access or does not scan these areas, its storage representation is intentionally smaller and focused on the data that matters for security posture.
• As a result, SharePoint/OneDrive storage will almost always appear larger than DSPM, often significantly larger depending on version history, retention policies, and recycle bin usage.

The following table shows the components that Microsoft includes in storage calculations, and whether DSPM includes or excludes these components.

Component	Microsoft Admin Center	DSPM	Notes
Teams sites	Yes	No	DSPM does not include Team sites in storage calculations. Teams sites require separate onboarding in DSPM. Microsoft treats Teams and SharePoint sites the same.
Latest version of files	Yes	Yes	Both DSPM and Microsoft report the size of the current/latest version of files stored in SharePoint or OneDrive. This is the version DSPM scans for sensitive data.
Old/Historical Versions	Yes	No	SharePoint and OneDrive store every version of a file. Microsoft counts all versions toward storage. DSPM can access only the latest version, since older versions are not available through Graph or SharePoint APIs. This is the main source of size discrepancies. Expect Microsoft to be 5x–20x higher for frequently edited files.
Recycle Bin Content	Yes	No	Items in the user’s Recycle Bin and OneDrive Recycle Bin still count toward Microsoft storage. DSPM does not scan or count deleted files because they are not discoverable through APIs. These folders often contribute 100 MB to several GB, especially after bulk deletions or migrations.
Second-stage/Site Collection Recycle Bin (SharePoint)	Yes	No	SharePoint has a hidden second-stage recycle bin that stores files after user deletion. Microsoft includes this in storage usage. DSPM cannot access or scan this area because it’s not exposed via Graph APIs.
Preservation Hold Library (PHL) (SharePoint)	Yes	No	If retention or legal hold is enabled, SharePoint stores retained copies in the PHL. This data is hidden, protected, and not exposed via APIs, but counts heavily toward storage. DSPM cannot access or scan PHL files as of today. This library alone may account for hundreds of MB or multiple GB for highly regulated tenants.
OneDrive Hold/eDiscovery Preservation Library	Yes	No	Under retention/hold, OneDrive stores preserved copies in a hidden “Hold” storage. Microsoft includes this in storage usage. DSPM cannot access these locations.
Hidden/System Libraries	Yes	No	SharePoint system folders (Site Assets, Pages, _catalogs, Style Library) and OneDrive system folders (thumbnails, caches, metadata stores) are counted by Microsoft. DSPM excludes these folders because they generally do not contain user content or scannable data. Scanning hidden libraries which can potentially contain sensitive data is on our product roadmap.
Retention Duplicates/Compliance Copies	Yes	No	When retention is enabled, both SharePoint and OneDrive create shadow copies of files when edited or deleted. These copies are hidden from users and APIs but are still counted toward Microsoft storage. DSPM cannot see these copies due to API unavailability.
System Metadata and Thumbnails	Yes	No	Thumbnails, previews, image caches, sharing link metadata, and .json config files are included by Microsoft. DSPM excludes them because they don’t contain sensitive data and are not relevant to data security posture.
Data Latency/Reporting Delay	Yes (24–72 hours)	No (Near real-time)	Microsoft Admin Center storage metrics are not real-time and may reflect a state from 1-3 days earlier. DSPM typically reports sizes based on real-time API calls during the most recent scan. Timing differences temporarily inflate discrepancies.