9,671 questions
Purview On-Prem Service Account - File Deleted?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(278.4, 95%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EB%3C/text%3E%3C/svg%3E)
Blue
0
Reputation points
Hi,
We have setup Microsoft Purview Information Protection, DLP and Insider Risk Management in Report / Monitor Mode. Additionally, we have configured the on-prem scanner (in Report Mode) to scan some on-prem file servers for us. The Information Protection Service Account only has READ permission on all the files and folders in the UNC location.
In "Activity Explorer", we have noticed that the Information Protection Service Account is reading the files on the UNC path (as expected), but there are a number of "File Deleted" actions being recorded too (Not expected).
Why are we seeing this "File Deleted" activity?
Example of what we are seeing in Activity Explorer below:
Thank you,
Blue
Microsoft 365 and Office | Install, redeem, activate | For business | Windows
Microsoft Security | Microsoft Purview
1,647 questions
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(268.8, 8%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EST%3C/text%3E%3C/svg%3E)
Smaran Thoomu 24,260 Reputation points Microsoft External Staff Moderator2024-12-09T14:44:01.23+00:00 Hi @Blue
Welcome to Microsoft Q&A platform and thanks for posting your query here.The "File Deleted" activity in the Activity Explorer of Microsoft Purview Information Protection may be caused by a number of reasons. Here are some potential causes:
- The files may have been deleted by a user or process that has access to the UNC path. This could be a legitimate deletion or a malicious action.
- The files may have been deleted by a process or application that is running on the file server. This could be due to a misconfiguration or a bug in the application.
- The files may have been deleted by the on-prem scanner itself. This could be due to a misconfiguration or a bug in the scanner.
To investigate the cause of the "File Deleted" activity, you can try the following steps:
- Check the audit logs of the file server to see if any user or process has deleted the files.
- Check the logs of any applications or processes running on the file server to see if they have deleted the files.
- Check the permissions of the Information Protection Service Account to ensure that it does not have the ability to delete files.
I hope this helps. Let me know if you have any further questions or concerns.
-
Smaran Thoomu 24,260 Reputation points Microsoft External Staff Moderator
2024-12-10T07:29:30.7066667+00:00 @Blue We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
-
Blue 0 Reputation points
2024-12-10T08:16:47.5766667+00:00 Thank you for your reply - however, all of your replies point to "deletion".
We have confirmed that the Service Account only has READ access to the files and folders it is scanning, and no data has been deleted.
Could there be another reason for the Activity Explorer to display the status of "file deleted"?
Thx
B
-
Smaran Thoomu 24,260 Reputation points Microsoft External Staff Moderator
2024-12-11T17:04:00.65+00:00 Hi Blue
Thank you for the update. If you have confirmed that the Service Account only has READ access to the files and folders it is scanning, and no data has been deleted, then it is possible that the "File Deleted" activity in the Activity Explorer is a false positive. This could be due to a bug or misconfiguration in the Purview Information Protection service.To investigate this further, you can try the following steps:
Check the logs of the on-prem scanner to see if there are any errors or warnings related to the "File Deleted" activity.
Contact Microsoft support to report the issue and provide them with the details of the false positive activity. They may be able to investigate the issue further and provide a resolution.
I hope this helps. Let me know if you have any further questions or concerns.
Sign in to comment
Sign in to answer