Forum Discussion
Sharepoint deleting data and sites
Hello,
We have noticed an issue that started about a year ago in which data is being deleted in Sharepoint. When looking at this data in the Recycle bin, it will show it was modified/deleted by specific Users but these user deny ever doing such a thing. It is at the point in which we believe the Sharepoint system itself is actually deleting data possibly due to a bug. It would be odd for the employees tagged in the Modified By field to have deleted it.
Our data is backed up so recovering any deleted items isn't the issue. The issue is that we are trying to get Microsoft to investigate. We have submitted tickets through the MS 365 portal but they state they only work on break/fix issues.
Any recommendations?
I can see searching the internet this issue has come up for many others in the past.
1 Reply
Unexpected deletions in SharePoint almost never occur because the platform is “randomly” deleting data. When an item appears in the Recycle Bin with a specific user listed as the one who deleted or modified it, it usually means something in that user’s environment or a connected process triggered the deletion, even if the user didn’t intentionally remove anything. Several common scenarios can make it look like SharePoint or the system is deleting items on its own:
- OneDrive Sync: If a user has synced a library and then renames or moves the synced folder, the OneDrive client may interpret this as a deletion and remove the corresponding files in SharePoint. These deletions are attributed to the user, even though they didn’t manually delete anything.
- Automations: Any flow connected to the list/library can delete items automatically, if any condition is written to delete items
- Retention policies: Microsoft Purview retention policies can automatically delete content after a certain period or based on specific conditions. These deletions may show as performed by the system or by the last user who modified the item.
- Versioning Limit: If versioning is configured with a low limit, SharePoint will automatically delete older versions. This can appear as user‑initiated deletion.
To determine the exact cause, the Microsoft 365 Audit Log is essential. You can access it at https://compliance.microsoft.com.
The audit log will show:
- Who performed the deletion
- The exact timestamp
- The client or app used (browser, OneDrive Sync, Power Automate, etc.)
- Whether the action was system‑initiated
If my post solved your issue or answered your query, please mark it as a Solution and give it a Like.
