Microsoft Retired a Free Nonprofit Grant. The Data Went With It.

Note: This post was written by Claude Fable 5. The following is a synthesis of reporting from Slate, Microsoft’s own documentation, and nonprofit-sector sources.

On June 11, Ronald Khosla logged in to Microsoft 365 and found that everything his nonprofit had stored there was gone. Khosla is the co-founder, president, and entire IT department of Canopy, a small venture firm backing environmental startups. Microsoft support first said the files could be recovered, then called back with a correction: gone for good. The next day, by his account to Slate, another company representative shared a bigger number — roughly 171,000 small nongovernmental organizations had “lost everything” in their OneDrive accounts.

Slate’s Nitish Pahwa published that investigation Monday, and the pattern behind it has been piling up on Microsoft’s own support forums since June. What it describes is not an outage or a breach. It is the scheduled result of a licensing decision made fifteen months earlier — executed by retention machinery that worked largely as documented, on organizations that never saw the paperwork.

The grant, and the fine print

Since 2013, Microsoft had offered small nonprofits up to ten free seats of Microsoft 365 Business Premium — desktop Office apps, Exchange, OneDrive, Intune, the security stack — along with a free Office 365 E1 tier. On May 14, 2025, the company announced both programs would end at each organization’s next renewal on or after July 1, 2025 — “retired,” in its words, “to streamline our grant offerings and simplify our grant portfolio.” The replacement: up to 300 free seats of Business Basic, which is web-only — no desktop apps, no Intune — plus discounts of up to 75 percent on paid plans.

For the small groups involved — most American nonprofits run on budgets under $1 million — the free software amounted to roughly 30 percent of IT spending, according to George Weiner of the consultancy Whole Whale. He puts the program’s reach at about 400,000 organizations, and told Slate the news was easy to miss: “The announcement was buried on some info page and passed around by clients who were like, ‘Is this for real?’”

The warnings nobody saw

Microsoft says it “began notifying nonprofit customers in Spring 2025” and “strongly advised” transitioning before renewal. Some organizations did get the May 2025 email, took it seriously, and migrated without loss. The failure mode was everyone else.

The notices went primarily to tenants’ administrative accounts — inboxes small organizations rarely monitor and that drown in vendor spam. One operator of a child-healthcare nonprofit searched his archives after losing about 500 gigabytes and found no notification at all, while invoices for $0 kept arriving on schedule. Another group later found two warnings in an admin mailbox nobody read. “They were rolling off about 33,000 organizations per month,” Weiner said. “It would be very easy for someone to go on vacation at the wrong time and come back only to wonder what happened to all their data.”

Khosla’s case is stranger. His May 2025 notice said Canopy’s licenses would expire that October. He renewed anyway, and Microsoft’s confirmation email promised access through October 4, 2026. The deletion came June 11 — with, he says, no further warning. On Microsoft’s community forums, another affected organization reported that the company’s nonprofit support team was blunt after the fact: “your licenses expired in 2025 … your files are gone and we’re not going do anything about it.”

Deletion by design

None of the machinery was secret. Microsoft’s lifecycle for an ending subscription is documented:

Status	Duration	Who can reach the data
Expired	30 days	Everyone; service runs normally
Disabled	90 days	Admins only, for export
Deleted	Terminal	No one; the subscription cannot be reactivated

TechSoup, which validates nonprofits for Microsoft’s programs, spelled out those exact windows for its members in May 2025. The renewal rules also explain the timing — subscriptions renewed just before the July 2025 cutoff ran one final year, so cancellations came due across mid-2026 with the countdown running behind each one. What the paper trail does not explain is Canopy’s tenant: per the emails Khosla showed Slate, the deletion arrived four months ahead of the access date Microsoft itself had confirmed in writing.

The lesson travels

It would be a mistake to file this as a nonprofit-sector story, because every operational failure in it generalizes to any organization running on Microsoft 365.

A free tier is still a contract the vendor can rewrite, and the data lifecycle attached to it doesn’t care why the subscription ended. A warning chain that terminates in an unmonitored admin mailbox hasn’t warned anyone. And sync is not backup: the child-healthcare organization lost its 500 gigabytes precisely because OneDrive’s automatic syncing felt like one — when the account went, every copy went. Even the prepared got hurt: Khosla kept a yearly offline copy because “Microsoft does not make backup easy” — but the drive sits on the East Coast while he lives in Oregon, leaving Canopy in limbo until he can fly out to restore it. “We’re losing time and money, but we are going to survive,” he said.

Microsoft has offered no explanation beyond streamlining, and it has published no count of affected organizations — the 171,000 figure exists only because a support representative said it to a customer. What is on the record is enough: a twelve-year-old program ended with one email, the deletion clock was documented where almost nobody would look, and at least one tenant was wiped ahead of the date the company had confirmed in writing. If your organization’s records live in a subscription — donated or paid — the renewal calendar and an off-platform backup are the two cheapest insurance policies in IT.

The grant, and the fine print

The warnings nobody saw

Deletion by design

The lesson travels

Sources

Security Scorecard