SharePoint online site deleted by System Account

Hi @Hanamichi Sakuragi ,

Based on your description, I want to confirm some information. Are you using SharePoint Online or SharePoint Server? I assume it to be SharePoint Online. If this is not your scenario, please let me know with more information of your current situation, screenshots will be helpful.

How many sites are deleted and what are the types of the sites?
Per my test, even the site has been deleted by a user account, “System Account” still will get displayed in the “deleted by” column. The screenshot below shows several sites deleted by two different user accounts, and none of them gets displayed in the column.

So in other words, we have no evidence to determine that the site has been deleted by a backed or automate process, like a timer job. Thus there is a possibility that someone with enough permission has deleted the sites. It will be better to contact and confirm with the admins in your tenant.

Of course, just like SharathKumarAluri-6456 said, the issue may be triggered by site closure and deletion policy, you can try to restore the sites to check if there is a site policy causing the sites to be deleted. Please have a check on the links provided by SharathKumarAluri-6456.

Best regards,
Elsie Lu

If the answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Check if the site deletion is triggered by any automate settings. For example, site closure and deletion policy or any workflow. such automate settings can trigger the delete action and the user is shown as "SHAREPOINT\system".

Check below articles for more Info:

https://support.microsoft.com/en-us/office/use-policies-for-site-closure-and-deletion-a8280d82-27fd-48c5-9adf-8a5431208ba5?ui=en-us&rs=en-us&ad=us

https://answers.microsoft.com/en-us/msoffice/forum/all/site-deleted-by-sharepointsystem-account/a1881dca-ae91-4486-87e3-c6c4096f4673

Thanks & Regards,

Any updates on this?? Our SPO environment do not have any policies configured and yet all the deleted sites show as deleted by System Account

Hmmm, that seems weird. I would say create a support ticket from the admin center and wait for the Microsoft to respond back. since, we don't control the logs it's hard for us to troubleshoot from here.

This is the direct link for your admin portal: https://admin.microsoft.com/AdminPortal/Home#/homepage , from the left click show all and select support and click on New Service Request

Thanks & Regards,