Sharepoint system account

Question

The sharepoint system account is deleting files. The recycle bin in sharepoint for a site keeps filling up.

Answer 1

Hi @Ian Marques, 

Based on your concern, seeing items continuously moved to the Recycle Bin by the System Account can cause operational disruptions.

To provide some context on the situation, I would like to share some potential causes behind this behavior. When the modifier of a file is listed as the System Account, it indicates that the deletion was triggered by an automated background process or tenant configuration, rather than a manual action taken by an individual user. This typically occurs due to Microsoft Purview retention policies configured to automatically purge older files, legacy library-level information management policies, or automated Power Automate workflows performing routine storage maintenance.

There are a few initial verification steps that can be performed at the site level to investigate the scope of these automated actions: 

1/ Review within Microsoft Purview: by logging into the Microsoft Purview compliance portal, navigating to Data Lifecycle Management, and auditing the active retention policies and retention labels to see if an active policy is deployed to target this specific SharePoint site collection.

2/ Review library settings: please navigate to the affected document library, select the gear icon for settings, choose library settings, click more library settings, and review the information management policy settings. 

3/ Examine active workflows: check for any active Power Automate flows or legacy workflows integrated with the library that possess delete permissions. 

4/ Identify file patterns: note whether the deletions target specific file types, paths, or items that share a common age profile, such as files older than a specific duration. 

Please note that reviewing retention policies, auditing logs, or modifying workflows requires administrative privileges (such as Global, SharePoint, or Compliance Administrator), which standard site users do not possess.

---

Since these processes originate at the tenant level, the best next step is to ask your IT administration team to open a support ticket in the Microsoft 365 Admin Center. This enables a Microsoft SharePoint support agent to analyze the Unified Audit Logs and backend timer jobs, pinpointing the exact policy responsible and providing guidance on safely structuring your future retention schedules.

• For detailed instructions on how to get support, please refer to Get support - Microsoft 365 admin.  
• In case you do not know who is your IT admin, kindly refer to this article: How do I find my Microsoft 365 admin? - Microsoft Support.

Also, please note that in SharePoint Online, deleted items are normally kept in the recycle bin for up to 93 days, and the first-stage recycle bin counts toward storage usage, which can explain why the recycle bin keeps filling up.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.