Forum Discussion

Copper Contributor

Dec 22, 2020

Solved

AAD to SharePoint Sync deleted the website twice

Today that one of our SharePoint sites was deleted for a second time, the first deletion was done yesterday and both without warning. I checked the deleted items section of the O365 SharePoint Admin site and there it was and i restore it back and it started working again. Anyone got any suggestions as to why this happens? the site has been working for several Months.

Looking at audit logs on protection.office.com revealed that the site was deleted by AAD to SharePoint Sync which and nothing more

Date:
2020-12-22 10:54:43
IP address:
User:
AAD to SharePoint Sync
Activity:
The site has been deleted
Object:
https://sharepint.sharepoint.com/sites/***
Information:

sharepoint

michaelsjodin
Dec 22, 2020
Hi

The issue was because Someone had created a Team from the Sharepoint Team banner, then tried to delete the team and when they do that the linked AD group got deleted as well which is why the deletion of SharePoint showed up as "AAD to SharePoint Sync". Doing and Audit for "Deleted team" reveled who made and deleted the team.

5 Replies

ChristianBergstrom
Silver Contributor
Dec 22, 2020
Sounds like a policy for closure and deletion.

https://support.microsoft.com/en-us/office/use-policies-for-site-closure-and-deletion-a8280d82-27fd-48c5-9adf-8a5431208ba5
- michaelsjodin
  Copper Contributor
  Dec 22, 2020
  Hi
  
  The issue was because Someone had created a Team from the Sharepoint Team banner, then tried to delete the team and when they do that the linked AD group got deleted as well which is why the deletion of SharePoint showed up as "AAD to SharePoint Sync". Doing and Audit for "Deleted team" reveled who made and deleted the team.
  - rowbot
    Copper Contributor
    Apr 02, 2025
    This helped but was not the answer in our case. In audit I did a search for a whole range of "Deleted *" items and it showed that someone in First Line had "Deleted Group" just minutes before the SharePoint site was deleted by "AAD to SharePoint Sync".
    It turns out they deleted a mail group because the name was too similar to a departments mail group and was causing confusion. Deleting the group actually deleted the SharePoint site which was unexpected.