Forum Discussion
Is there any way to detect mass file deletion in Sharepoint in Office 365?
Did you see these https://blogs.office.com/en-us/2018/04/05/defend-yourself-from-cybercrime-with-new-office-365-capabilities/, which is a step in the right direction for this sort of thing but not exactly what you're after.
"OneDrive scans files on download for known threats, provides file versioning for all file types, and sends notifications if a mass file deletion is detected."
Great if this could be brought to libraries, where mass anomalies are flagged to admins.
Saying all that, check out https://support.office.com/en-gb/article/overview-of-office-365-cloud-app-security-81f0ee9a-9645-45ab-ba56-de9cbccab475, which has https://support.office.com/en-gb/article/anomaly-detection-policies-in-office-365-cloud-app-security-88935b4e-dcb1-47f1-8aca-1bf8fb069db6like 'unusual file deletion activity' that can alert on suspicious activities. This comes at an additional cost unless using E5.
Have a look at the Microsoft 365 roadmap, Feature ID: 31754
SharePoint and OneDrive: mass delete notification
Well, it is a start, but....
To help raise awareness of possible uncommon or accidental file deletions (based on a 'higher than usual' number of deleted files per hour), people will be notified if a large number of files are deleted. For OneDrive, if a large number of files are deleted from a person's OneDrive, that person - the *owner* - will be sent an email notification letting them know about it and pointing them to the Recycle Bin in case they want to restore. For SharePoint team sites, if a large number of files are deleted, the *person that deleted them* (site owner or member) will be sent an email notification letting them know about it and pointing them to the Recycle Bin in case they want to restore. Each email notification will include an unsubscribe link at the bottom for those that wish to opt out of this type of notification.
I'd like an admin to be notified of a large number of sharepoint file deletions, not the disgruntled employee that is whacking a bunch of stuff.