Forum Discussion
Microsoft Changes Name of File Deleted Audit Event
For years, I have scanned the audit log to find FileDeleted events to report deletions of SharePoint and OneDrive documents. Now, FileRecycled audit events are used instead. This wouldn’t be a problem if Microsoft had told customers, but not a trace can be found to let organizations know that the audit data they use for compliance operations has changed. I don’t know if this is the only activity name change, but given that one update has happened (and for a relatively important audit event), it’s likely that others lurk in the undergrowth.
https://office365itpros.com/2023/08/18/filerecycled-audit-event/
1 Reply
First time confusingly looking into the audit logs for who deleted a file. Although this is after the fact that things have changed it is still confusing to see 'Deleted file' as an activity, or I might misunderstand, and this is the state when really purged from the system and recycled is just in the recycle Bin. Time to hit the books :)
