The admin centre says the site is using 412 GB. You open the document library, select everything, and the total is 60 GB. You delete 30 GB of old exports. The next morning the site is using 412 GB. This post is the list of places the other 350 GB can be, in the order they are usually responsible.
0. The number is two days old
Site storage usage updates on roughly a 24–48 hour cycle. Whatever you deleted this morning will not show until tomorrow or the day after. Before investigating anything, check when you last changed something.
1. Version history
Every version of every file counts in full. A 30 MB deck with 200 versions is 6 GB. In a library where people work on large Office files with autosave, versions are routinely 60–90% of the total. The modern library view shows current file size only; it never shows this.
See it: Site settings → Storage Metrics (/_layouts/15/storman.aspx). Per-file Total Size there includes versions. To quantify it per library, run the ten-minute version audit.
2. The recycle bins
Deleted items stay for 93 days across the site recycle bin and the second-stage bin, and both count against the site. A "clean-up" that deletes 100 GB moves 100 GB into the bin; the site total does not change until day 93 or until an admin empties the second-stage bin.
See it: Site contents → Recycle bin (as a site collection admin, to see everyone's) → Second-stage recycle bin.
3. The Preservation Hold Library
If a Purview retention policy or label applies to the site, deleting or editing a file puts a copy in the hidden Preservation Hold Library. Nothing you delete leaves the site; it changes address. On sites under a multi-year hold this library is often the single largest thing on the site.
See it: https://<site>/PreservationHoldLibrary/Forms/AllItems.aspx as a site collection admin. It also appears in Storage Metrics.
4. Other libraries, lists and pages
Site Assets (images pasted into pages), Site Pages, Form Templates, list attachments, a Teams channel's private-channel site that is technically a separate site collection. Storage Metrics lists them all; the document library is usually not the only one.
5. The tenant pool, not the site
The warning banner says "your organisation is running out of storage", not "this site". SharePoint storage is one pool: 1 TB + 10 GB per licensed user (frontline F licences do not add to it). A site can be fine and the tenant full because forty other sites grew. SharePoint admin centre → Active sites → sort by Storage used.
The quick triage
Connect-SPOService -Url https://contoso-admin.sharepoint.com
Get-SPOTenant | Select-Object StorageQuota, StorageQuotaAllocated
Get-SPOSite -Limit All | Sort-Object StorageUsageCurrent -Descending |
Select-Object -First 15 Url, StorageUsageCurrent, StorageQuota
That ranks sites. Then Storage Metrics on the top few. Then the version audit on the biggest libraries.
Seeing all five at once
The manual route is four pages, two permission levels and a 48-hour wait between checks. Storage Analyzer runs the same reads from a SharePoint page: what you can see (current content) versus what you are storing (the site total), the version-history estimate, and an "unaccounted for" figure that points at recycle bins and the Preservation Hold Library, with libraries ranked largest first. The site view is free; the version drill-down and CSV export come with a TrimVersions365 key.