Audit logs in sharepoint online

Question

User want to know who deleted the folders , this happened in march 2022
since recyle bin is only for 30 days, it is not available in bin.
so but customer wants to know who delete it and it happened in the month of march.
But audit log is not enabled. is there any way to know it?

If there is no solution, to be cautious in future we want to enable audit log for the site collection, is it possible? If yes how? Please help. thanks.

I navigated to site audit log settings, but found some of the referance link, but not sure, how exactly audit log need to be implemented for online site

Answer 1

Hi there,

You can try searching the Audit Log feature in https://compliance.microsoft.com/ and it is described in https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#search-the-audit-log.

However, it may not be possible to consult activities from 6 months ago depending on requirements and licensing. For a general perspective you could read the FAQ section in the same article: https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#frequently-asked-questions .

To avoid unwanted deletion in the future you could look also in the future the Retention Policy in Microsoft 365 for Sharepoint Online: https://learn.microsoft.com/en-us/microsoft-365/compliance/retention-policies-sharepoint?view=o365-worldwide but this is also just a suggestion of course.

I hope this helps!
-DF

Answer 2

Hi @sns ,
I agree with DanF-PT, you can use the audit log search tool in Microsoft 365 Compliance center to check the deleted folder activity in your organization:

But one thing to clarify: audit records for activities performed by users assigned an Office 365 E5 or Microsoft E5 license (or users with a Microsoft 365 E5 add-on license) are retained for one year.For all other subscriptions that support unified audit logging, audit records are retained for 90 days.

To turn on audit log search, you can run the following command in Exchange Online PowerShell:
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.