One can intentionally or accidentally delete some files from SharePoint. If it is from OneDrive, you can ignore the fact as it is a personal storage & supervised by one.
However, if the files are deleted from MS Teams or Outlook, it can be critical as those can be confidential or essential files & need to audit who deleted this to prevent data breaches & security.
In this article, I will show you quickly how you can learn who deleted SharePoint files, so that you can take further measures to recover the files when required. Let’s dive in.
If someone deletes some files from Microsoft Teams or OneDrive, the files don’t remove permanently at that time. The files are protected by a two-stage recycle bin in SharePoint.
When files are deleted from MS OneDrive or Teams, you can access the recycle bin in SharePoint & further permanently delete the files or recover the files when it’s required.
As MS Teams group members can delete any files, it’s important to have knowledge of who did the work. Usually, all group members can access the First-stage recycle bin & recover or remove files from there. The site owner or admin can access the second-stage recycle bin to further retain or delete files within retention time.
SharePoint has an audit log that records if someone deletes a file or folder. It captures a FileDeleted event when the process happens. However, the files can also be removed for the retention policy too.
As members can access the First-stage recycle bin & further remove a file from there, it is vital to be informed by whom the files are deleted. Because most often it is a normal activity, but sometimes it can be done to hurt the site owner & it seems like they don’t want to get caught.
SharePoint audit log captures FileDeletedFirstStageRecycleBin when someone erases an item from the first recycle bin. When the admin deletes the file from the Second-stage recycle bin, it captures as FileDeletedSecondStageRecycleBin audit log.
So to find who deleted a file in SharePoint, follow as below.
- Go to Sharepoint online.
- Click on the gear icon from the top right side.
- Select Site settings.
- Click on Site collection features under Site Collection Administration.
- Scroll down a little, find Reporting, and hit Activate from the right side.
- Go back to Site settings & click on Audit log reports.
- Select Deletion.
- Set a location to save your log file & hit OK twice.
After that, a log file will be generated. To open the audit file, select Click here to view the report, which will open the file on MS Excel. From there you will find SharePoint online deletion logs.
An alternative way is, access to the SharePoint Recycle bin. There you will find a detailed report of Date deleted, Deleted by, Created by & Original location.
Final Thought
Someone can delete a SharePoint file for a good reason or with bad intentions. That’s why it is essential to acknowledge the username who deleted a file.
In this article, I showed you how to check the username who deleted files in SharePoint. If you have any further queries, please leave a comment.
