Audit Logs Not Capturing Deleted Sites in Sharepoint

%3CLINGO-SUB%20id%3D%22lingo-sub-29649%22%20slang%3D%22en-US%22%3EAudit%20Logs%20Not%20Capturing%20Deleted%20Sites%20in%20Sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-29649%22%20slang%3D%22en-US%22%3E%3CP%3EWondering%20can%20anyone%20help%20with%20finding%20or%20enabling%20sharepoint%20so%20it's%20logging%20when%20someone%20deletes%20a%20site.%3C%2FP%3E%3CP%3EWe%20have%20had%20an%20occassion%20where%20someone%20accidently%20deleted%20a%20team%20site%20but%20the%20audit%20logs%20on%20security%20compliance%20doesn't%20capture%20this.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20somewhere%20else%20we%20can%20search%20to%20see%20who%20did%20it%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-84564%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Logs%20Not%20Capturing%20Deleted%20Sites%20in%20Sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-84564%22%20slang%3D%22en-US%22%3E%3CP%3EI%20believe%20you%20need%20to%20turn%20on%20site%20collection%20auditing%20to%20capture%20site%20deletion%20activity.%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EI%20just%20tried%20quick%20site%20creation%20on%20two%20different%20site%20collections%20one%20with%20site%20collection%20auditing%20enabled%20and%20other%20is%20not.%20When%20I%20delete%20those%20sites%2C%20I%20could%20get%20the%20activity%20for%20the%20site%20collection%20auditing%20enabled%20one.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-82097%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Logs%20Not%20Capturing%20Deleted%20Sites%20in%20Sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-82097%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20David%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20just%20did%20a%20quick%20test%2C%20creating%20a%20SharePoint%20Online%20site%20and%20then%20deleting%20it.%20%26nbsp%3BThe%20deletion%20event%20was%20captured%20in%20the%20Audit%20Log.%20%26nbsp%3BIf%20this%20is%20still%20an%20issue%20for%20you%2C%20could%20you%20please%20provide%20more%20detail%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F16413i736CB742A0716024%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22SPO_DeletedSiteLog.PNG%22%20title%3D%22SPO_DeletedSiteLog.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-30131%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Logs%20Not%20Capturing%20Deleted%20Sites%20in%20Sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-30131%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20That%20one%20might%20be%20a%20little%20outside%20my%20wheel%20house%20to%20write.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20find%20it%20funny%20that%20the%20audit%20logs%20does%20capture%20the%20site%20creation.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20rasied%20it%20via%20support%20as%20a%20feature%20request.%26nbsp%3B%20Seems%20to%20me%20a%20large%20security%20hole%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-29790%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Logs%20Not%20Capturing%20Deleted%20Sites%20in%20Sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-29790%22%20slang%3D%22en-US%22%3EUnfortunately%2C%20the%20site%20and%20site%20collection%20deletion%20events%20are%20not%20currently%20provided%20in%20the%20Audit%20Log%20Search%20at%20the%20Compliance%20%26amp%3B%20Security%20Center.%20Neither%20this%20information%20is%20provided%20by%20ative%20audit%20log%20features%20in%20SPO...the%20only%20way%20I%20see%20you%20could%20get%20this%20information%20is%20by%20querying%20the%20change%20log%20in%20SPO%20using%20Client%20Side%20Object%20Model%20programming%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-29754%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Logs%20Not%20Capturing%20Deleted%20Sites%20in%20Sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-29754%22%20slang%3D%22en-US%22%3E%3CP%3ESharePoint%20has%20always%20lacked%20properr%20auditing%2C%20I%20dont%20think%20there%20is%20a%20way%20to%20see%20this%20currently.%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F60%22%20target%3D%22_blank%22%3E%40Juan%20Carlos%20Gonz%C3%A1lez%20Mart%C3%ADn%3C%2FA%3E%26nbsp%3Bmight%20be%20able%20to%20give%20more%20insight%20here.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Wondering can anyone help with finding or enabling sharepoint so it's logging when someone deletes a site.

We have had an occassion where someone accidently deleted a team site but the audit logs on security compliance doesn't capture this.

 

Is there somewhere else we can search to see who did it

5 Replies

SharePoint has always lacked properr auditing, I dont think there is a way to see this currently. @Juan Carlos González Martín might be able to give more insight here.

Unfortunately, the site and site collection deletion events are not currently provided in the Audit Log Search at the Compliance & Security Center. Neither this information is provided by ative audit log features in SPO...the only way I see you could get this information is by querying the change log in SPO using Client Side Object Model programming

Thanks That one might be a little outside my wheel house to write.

 

I find it funny that the audit logs does capture the site creation.

 

I've rasied it via support as a feature request.  Seems to me a large security hole

Hi David,

 

I just did a quick test, creating a SharePoint Online site and then deleting it.  The deletion event was captured in the Audit Log.  If this is still an issue for you, could you please provide more detail?

 

 

SPO_DeletedSiteLog.PNG

I believe you need to turn on site collection auditing to capture site deletion activity. 

I just tried quick site creation on two different site collections one with site collection auditing enabled and other is not. When I delete those sites, I could get the activity for the site collection auditing enabled one.