Auditing file deletion on SharePoint Online

Question

Hello,

I have a user who is claiming that no one deleted their file on MS Teams. If it was deleted a long time ago, it was already deleted from recycle bin. How can I investigate this? There is no auditing for this on SP Online anymore. Is there any way to do it through Compliance on Admin Center? Or any other way?

Thank you

Answer 1

@Dee Akil ,

Agree with michev, we can use the audit log search tool in Microsoft 365 Compliance center to check the deleted file activity in your organization:

As a supplement, audit records for activities performed by users assigned an Office 365 E5 or Microsoft E5 license (or users with a Microsoft 365 E5 add-on license) are retained for one year.

For all other subscriptions that support unified audit logging, audit records are retained for 90 days.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---

Answer 2

You can perform a search against the Unified audit log: https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide