Share via

Need to know when a user was deleted from Microsoft 365 several years ago

Sarah Thompson 20 Reputation points
2023-08-24T22:21:39.7666667+00:00

Hi,

A user was deleted from my organization several years ago (sometime in 2018 or 2019). Is there any way for me to be able to find out when their account was deleted EXACTLY? I need to know because this user's data is subject to a litigation and I need to be able to prove that the account was deleted before we received notice of the legal action. If it's not logged or the log isn't retained for this long, are any notifications sent to the person that deleted the account or perhaps we could find evidence elsewhere?

Any help or ideas is much appreciated.

Thanks!

Microsoft 365
Microsoft 365
Formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line.
4,364 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,630 questions
0 comments
Accepted answer
  1. Sandeep G-MSFT 16,696 Reputation points Microsoft Employee
    2023-09-06T07:11:09.79+00:00

    @Sarah Thompson

    Usually deleting user will be tracked in Azure AD Audit logs. By default, if you have a subscription you can see about last 30 days of logs.

    If you do not have any subscription linked to directory, then only last 7 days logs are stored.

    If you are looking for a deleted user audit log for year 2018 or 2019 then it is not possible.

    If you had created a backup for logs from Azure AD then you can search for user deletion in those logs.

    About notifications when user is deleted, to get notification you will have to configure notifications. You can refer below article for the same,

    https://learn.microsoft.com/en-us/graph/webhooks

    Let me know if you have any further questions.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Dillon Silzer 56,681 Reputation points
    2023-08-25T01:01:20.74+00:00

    Hi Sarah,

    I doubt you would be able to find those logs within Entra/Azure AD. My biggest suggestion is to open a case with Microsoft Support and see if they can pull up these records.

    Go to https://admin.microsoft.com/ > Help & Support:

    User's image

    Then create a ticket via the support channel. Entra/Azure AD typically keep logs up to 90 days.

    If this is helpful please accept answer.