Sharepoint deleting data and sites

Unexpected deletions in SharePoint almost never occur because the platform is “randomly” deleting data. When an item appears in the Recycle Bin with a specific user listed as the one who deleted or modified it, it usually means something in that user’s environment or a connected process triggered the deletion, even if the user didn’t intentionally remove anything. Several common scenarios can make it look like SharePoint or the system is deleting items on its own:

• OneDrive Sync: If a user has synced a library and then renames or moves the synced folder, the OneDrive client may interpret this as a deletion and remove the corresponding files in SharePoint. These deletions are attributed to the user, even though they didn’t manually delete anything.
• Automations: Any flow connected to the list/library can delete items automatically, if any condition is written to delete items
• Retention policies: Microsoft Purview retention policies can automatically delete content after a certain period or based on specific conditions. These deletions may show as performed by the system or by the last user who modified the item.
• Versioning Limit: If versioning is configured with a low limit, SharePoint will automatically delete older versions. This can appear as user‑initiated deletion.

To determine the exact cause, the Microsoft 365 Audit Log is essential. You can access it at https://compliance.microsoft.com.

The audit log will show:

• Who performed the deletion
• The exact timestamp
• The client or app used (browser, OneDrive Sync, Power Automate, etc.)
• Whether the action was system‑initiated

If my post solved your issue or answered your query, please mark it as a Solution and give it a Like.