Are you struggling to identify who deleted a SharePoint file?

Files in SharePoint can be intentionally or accidentally deleted. The frustration is real when crucial documents vanish, impacting your workflow. Losing a crucial file can disrupt workflows and hinder productivity, making it imperative to identify the culprit behind the deletion. Fortunately, SharePoint provides tools and features to trace the steps and unveil who deleted files.

In this article, you will be taken through the process of finding who deleted SharePoint files, empowering you with the knowledge to safeguard your digital assets and maintain a transparent collaborative environment.

Check Who Deleted Files from the Audit Log in SharePoint Online

When a file is deleted from Microsoft Teams or OneDrive, the files are not just removed permanently at that time.  These files are protected by a two-stage recycle bin in SharePoint.

📝 Note:The main function of the recycle bin in SharePoint is to protect data that is deleted accidentally or intentionally.  Deleted items are kept for 93 days from the time of deletion.

As files are deleted by Microsoft Teams members, it is important to know who made the deletion. Usually, the first-stage recycle bin in SharePoint can be accessed by group members in which they can recover and retain deleted files from the bin while the second-stage recycle bin can be accessed by the site owner (Admin) to further retain or delete files within the retention period.

SharePoint has an audit log that keeps records of files and folders deleted by someone. It captures the FileDeleted event immediately when the initiation happens. However, these files can also be removed for retention policy.

Also, the SharePoint audit log captures FileDeletedFirstStageRecycleBin when someone deletes an item(s) from the first recycle bin. But, when the admin or site owner deletes files from the second stage recycle bin, it has been captured as FileDeletedSecondStageRecycleBin audit log.

Follow these steps to check who deleted the file in SharePoint online from the audit log.

1. Login to your Office 365 tenant.
2. Click on the App launcher at the top left corner of your page.
3. Click on SharePoint.

This will take you to your SharePoint site.

4. Next, click on the gear icon at the top right corner of the site. This will display a panel.
5. Select the Site settings link.

This will redirect you to the Site sitting page in SharePoint Online

6. Under the Site Collection Administration, click on Site Collection features.

This redirects you and displays the site collection features in SharePoint online. Scroll down until you find Reporting.

7. On the Reporting, hit the Activate button. This will activate the Audit log report in the Site setting.

8. Go back to the Site settings and click on Audit log reports.

9. This will redirect you to the Auditing Reports page. On this page, click on Deletion.

This will display the Customize Report page to set a location to store your audit logs. On this page,

10. Click on Browse.  This will load up your SharePoint library to set a location.
11. Click on Documents.
12. Click on OK on the library.
13. Click on OK.

After that, the page will load displaying Working on it. When it is done, the file will be generated. To open the audit file, this will open on Microsoft Excel. From there you will be able to find your SharePoint Online deletion logs which contain the files deleted and the person who deleted the file.

An alternative way is to check from the recycle bin directly on the SharePoint site. This is simple, just click on Recycle bin on the left corner of your SharePoint site. Inside, you will find a detailed report of the Date Deleted, Deleted by, Created by, and the original location of the files that were deleted.

Check who Deleted a File from the Recycle Bin in Microsoft Teams

SharePoint Online seamlessly integrates with Microsoft Teams, streamlining communication and file management. This synchronization enhances efficiency by providing direct access to SharePoint files within the Teams interface. However, when files are unexpectedly deleted and find their way into the Recycle Bin, tracking down the culprit becomes crucial. In this context, understanding how SharePoint interacts with Microsoft Teams is fundamental to uncovering the mystery of deleted files.

To check who deleted a file from Microsoft Teams, follow these steps.

1. Login to your Microsoft Teams account.
2. Navigate to your team’s site of interest where the file was deleted.
3. To view the files, click on Files.
4. Click on Open in SharePoint.

This will redirect you to the SharePoint folder where the files are stored.

5. Present in the SharePoint Site opened, Click on Recycling Bin.

Inside the recycling bin, you will find the details about the deleted files including the Deleted by column which shows the person who deleted the file present in the recycling bin.

Also, an alternative way to check the recycling bin to show who deleted a file in SharePoint Online is from Site Contents. This is mostly utilized when you do not see the recycling bin option in the navigation. To do this, follow these steps.

1. Click on the gear icon (settings) from the top right corner of the page.
2. Select the Site contents.

3. Finally click on the Recycle bin at the top right corner of the page. The recycling bin icon shows the summary of the total files that have been deleted from the Teams site.

This will show the deleted files alongside the column showing the person who deleted the file as explained earlier.

Another way to check the recycling bin for who deleted a file in SharePoint Online is from the site settings. This option is mostly utilized by SharePoint admins.

This means that for you to explore this option, you must be a SharePoint admin. Follow these steps to utilize this option as a SharePoint admin.

1. Login to SharePoint Online as an admin
2. Click on the gear icon (settings) at the upper right corner of the page.
3. Click on Site Settings.

This will redirect you to the site settings page. Locate Site Collection Administration

4. Click on the recycle bin.

This will display all the deleted files on your communication Team site. On the Recycle bin, you will see all the deleted files alongside other details including the person that deleted each file.

Checking Who Deleted a File in SharePoint Online Using PowerShell

When it comes to investigating file deletions in SharePoint, PowerShell emerges as a formidable ally for administrators. This script, utilizing the Connect-PnPOnline cmdlet and Get-PnPRecycleBinItem, provides a straightforward solution to identify users responsible for file deletions.

Let’s delve into the script, step by step, to understand how it seamlessly connects to your SharePoint site and extracts valuable information about deleted files.

Connect-PnPOnline -Url "https://<TENANT-NAME>.sharepoint.com/sites/<YOUR-SITE>" -Credentials <your-creds>

1. Firstly, you must connect to SharePoint Online. Write the command to initiate a connection to your SharePoint Online site. Replace <TENANT-NAME> and <YOUR-SITE> with your specific details. The -Credentials parameter ensures secure access. Include your credentials to authenticate to your SharePoint Online site.

$allDeletedItems = Get-PnPRecycleBinItem

2. These retrieves deleted items from the recycling bin. Using Get-PnPRecycleBinItem, the script fetches all items currently residing in the SharePoint Recycle Bin, creating an array named $allDeletedItems to store these items.

$results = @()

3. Initialize an empty array for the result. This line initializes an empty array named $results to store information about deleted files, including the file name, the user who deleted it, and the deletion date.

foreach($item in $allDeletedItems){
    # Script content goes here
}

4. This script iterates through each item in the recycling bin. The foreach loop iterates through each item in the $allDeletedItems array, allowing us to extract specific details for analysis.

$results += [pscustomobject]@{
    fileName = $item.LeafName
    deletedBy = $item.DeletedByName
    deletedDate = $item.DeletedDate    
}

5. This part of the script is inserted inside Script content goes here in the forth step of the PowerShell code. This captures file information. Within the loop, this code snippet captures essential information for each deleted file, creating a custom PowerShell object with properties for the file name $item.LeafName, the user who deleted it $item.DeletedByName, and the deletion date $item.DeletedDate.

$results

6. Finally, the script outputs the results, presenting a comprehensive list of deleted files along with the associated user and deletion date.

Also, you can utilize the SharePoint Online Management Shell and access the audit logs.

📝 Note: You need to have SharePoint Online Management Shell installed on your computer.

Follow these steps.

Connect-SPOService -Url https://yourdomain.sharepoint.com

1. This script will create a connection to your SharePoint Online. Replace yourdomain with your actual SharePoint domain.
2. Ensure that audit log is enabled on your SharePoint Online site to track file deletion. You can enable it by going to the SharePoint admin center, selecting the site collection, and enabling auditing in the Audit Log Settings.

Search-SPOAuditLog -EventType "Delete" -ItemName "/sites/yoursite/Shared Documents/yourfile.docx"

3. Use the Search-SPOAuditLog command to retrieve the audit log entries related to file deletions. You can filter the results based on the event type and the file path. Replace /sites/yoursite/Shared Documents/yourfile.docx with the actual path of the deleted file.
4. The Search-SPOAuditLog command will return the audit log entries for the specified file deletion. You can review the entries to find information about who deleted the file, the date and time of deletion, and other relevant details.

By incorporating this PowerShell script into your SharePoint management arsenal, administrators can efficiently track file deletions, ensuring transparency and accountability within the SharePoint environment.

Conclusions

The quest to identify who deleted SharePoint files is pivotal for maintaining order and accountability in collaborative environments.

Whether files are removed intentionally or accidentally, the outlined methods provide a comprehensive approach to tracing the culprits. From leveraging SharePoint’s native tools and audit logs to exploring Microsoft Teams’ Recycle Bin and employing the efficiency of PowerShell scripts, administrators now possess a toolkit to safeguard digital assets and uphold transparency.

By implementing these strategies, you not only regain control over file management but also fortify the collaborative integrity of your SharePoint Online environment.