sharepoint online email received on deleted AD account, but account wasnt deleted and is still active

Raheem Anderson 20 Reputation points
2023-03-09T07:12:58.51+00:00

Hi, a user at my workplace received an email from no-reply@sharepointonline.com indicating one of her employees <"Names" account has been deleted from the Active Directory. Their OneDrive for Business will be preserved for 30 days.....etc.>
The account was not deleted, and is still active on AD. Nothing in the logs indicate it has been deactivated and activated again either.

Do you know why she might have received this email?

SharePoint
SharePoint
A group of Microsoft Products and technologies used for sharing and managing content, knowledge, and applications.
9,795 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,962 questions
{count} votes

Accepted answer
  1. Haoyan Xue_MSFT 20,431 Reputation points Microsoft Vendor
    2023-03-14T09:17:26.18+00:00

    Hi @Raheem Anderson

    Under normal circumstances, this will only happen if the Azure AD user is deleted.

    1.Please check M365 Admin center, whether the account is in Active Users or Deleted Users.

    2.Have you checked whether the user has been deleted through the Audit log? If not, you can check to see if there is a delete record.

    Go to https://compliance.microsoft.com and sign in. In the left pane of the compliance portal, select Audit.

    Configure criteria and then select Search to run report.


    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.
    0 comments No comments

1 additional answer

Sort by: Most helpful
  1. Steve Young 0 Reputation points
    2023-11-08T21:46:39.1733333+00:00

    This is just a dumb wording issue with the automated emails. Imagine the scenario where Janet is Jim's supervisor and Jim gets fired. When Jim's account is disabled but not yet deleted, a lot of organizations have it setup to give "ownership" of the account to his supervisor so she can access Jim's email/onedrive. So now Janet "owns" Jim's account and that account is finally deleted from AD.

    Here is where the wording gets stupid. Instead of saying "An account Janet owns has been deleted" it says, "Janet's account has been deleted". But if you look at the onedrive sharing URL at the bottom of the message it will have Jim's username somewhere in it.

    0 comments No comments