Forum Discussion
Files being deleted by System Account SharePoint Online
Starting late July, I've had items deleted from libraries in our root SharePoint Online site as well as subsites by "System Account". We've checked various Flows (but with the delete coming from System Account, that seems unlikely, as well as the number of libraries involved). This appears to be happening every 5 to 6 days, and the files deleted are those that aren't modified frequently (I noticed because a spreadsheet I update once a month keeps getting deleted).
We don't appear to be using any records management features - I checked a couple of the libraries and no policies seem to be set under Information Policy Management. Also, because this is happening on so many subsites & libraries, it seems like it must be something at the site level.
I also took a look at protection.office.com to see if there was anything there.... Clicking on Records Management category on the sidebar just toggles the up/down arrow and doesn't navigate anywhere.
Click here: https://protection.office.com/unifiedauditlog
And the documentation is here: https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance
7 Replies
Probably a retention policy configured in the Security and Compliance center? What does the Audit log show for such events?
VasilMichev Can you tell me where to find the Audit Log for SharePoint Online?
Click here: https://protection.office.com/unifiedauditlog
And the documentation is here: https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance
Hilary Stoupa Could you please confirm you have verified the retention policy check in SharePoint online admin center.
To check that please follow the link: https://docs.microsoft.com/en-us/office365/securitycompliance/retention-policies
Another helpful link is : https://sharepointmaven.com/set-retention-deletion-policies-files-folders-sharepoint/
Vikram_Samal Can you tell me where I should go to check this? I'm sorry - I'd already read the linked article prior to posting, but I am having trouble figuring out where to find these settings in the SharePoint Online Admin Center - did I overlook this in the article? I'm assuming this is an organization wide policy of some kind (though none of my colleagues recall configuring one...)
- Both things are not in the SPO Admin Center, you will find them in the Security & Compliance Center
