Anomalous "File Versions Deleted" Activity – SHAREPOINT\system

Question

We have observed multiple "File Versions All Deleted" events associated with the account SHAREPOINT\system, originating from different geolocations, which appears suspicious.

We would like to understand whether SHAREPOINT\system is a default system-generated account used by SharePoint/Microsoft 365 for backend or automated activities, or if it represents an actual user account.

Additionally, we are noticing frequent daily activity logs from this account. Could you please confirm if this behavior (including actions from multiple geo locations) is expected for system-level operations?

Answer 1

Good day Ranjitha, and I appreciate the clear explanation of your concern.  

Just to gently clarify before we go any further, this is a user‑to‑user support forum. I don’t have the ability to access or investigate individual accounts because this is a user-to-user support forum. Moderators and contributors, including external Microsoft employees, do not have access to internal systems or the ability to directly take action on Microsoft product features. However, I truly hope I can help review your situation, offer some guidance, and support you in finding the right next steps as best as possible.   

The account SHAREPOINT\system is generally a built in SharePoint system identity used by SharePoint Online and Microsoft 365 services for certain background and automated operations. It doesn't typically represent a standard end-user account. 

It is also normal to see recurring audit activity associated with SHAREPOINT\system when SharePoint performs automated tasks. In addition, activity originating from different geolocations can be expected in some cases because Microsoft 365 services operate across multiple datacenter locations and service infrastructure. 

That said, the specific audit event "File Versions All Deleted" should be reviewed in the context of your SharePoint configuration to determine what triggered the action. Common areas to check include: 

1/ Version history settings 

• Review the version history configuration for the affected document libraries. 
• Check whether version limits or automatic version management settings are configured. 

2/ Retention and compliance policies 

• Verify whether any retention policies or retention labels are applied to the affected sites or libraries. 
• Confirm whether any policy actions could be affecting file versions. 

3/ Automated processes and workflows 

• Review any workflows, automation, migration activities, or administrative tasks that may be performing version cleanup operations. 

Additional information is available in the following resource: Detailed activity properties in the audit log | Microsoft Learn 

If you are unable to identify any configuration, policy, or administrative action that aligns with these events, I recommend opening a Microsoft support request via Microsoft 365 Admin Center > Support > Help & Support for further backend validation: 

• Turn off the "Support Assistant" feature.   
• Use the keyword "Support" to quickly bypass automated suggestions > Select Contact Support.   

• In the ticket description, please clearly describe the behavior, including any audit log details, the source of the logs. You can also attach screenshots or screen recordings. 
• Additionally, sharing your preferred contact times may help the support team handle the case more efficiently.    

I hope this information help clarify your concern in time. If you have any questions or need further support, please don’t hesitate to reach out at any time. 

Thank you for your patience and understanding. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have any extra questions about this answer, please click "Comment".            

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.