SOLVED

AAD to SharePoint Sync deleted the website twice

%3CLINGO-SUB%20id%3D%22lingo-sub-2009156%22%20slang%3D%22en-US%22%3EAAD%20to%20SharePoint%20Sync%20deleted%20the%20website%20twice%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2009156%22%20slang%3D%22en-US%22%3E%3CDIV%20class%3D%22votecell%20post-layout--left%22%3E%3CDIV%20class%3D%22js-voting-container%20grid%20jc-center%20fd-column%20ai-stretch%20gs4%20fc-black-200%22%3E%3CSPAN%3EToday%20that%20one%20of%20our%20SharePoint%20sites%20was%20deleted%20for%20a%20second%20time%2C%20the%20first%20deletion%20was%20done%20yesterday%20and%20both%20without%20warning.%20I%20checked%20the%20deleted%20items%20section%20of%20the%20O365%20SharePoint%20Admin%20site%20and%20there%20it%20was%20and%20i%20restore%20it%20back%20and%20it%20started%20working%20again.%20Anyone%20got%20any%20suggestions%20as%20to%20why%20this%20happens%3F%20the%20site%20has%20been%20working%20for%20several%20Months.%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22postcell%20post-layout--right%22%3E%3CDIV%20class%3D%22s-prose%20js-post-body%22%3E%3CP%3E%3CBR%20%2F%3ELooking%20at%20audit%20logs%20on%20protection.office.com%20revealed%20that%20the%20site%20was%20deleted%20by%20AAD%20to%20SharePoint%20Sync%20which%20and%20nothing%20more%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3CPRE%3E%3CSPAN%20class%3D%22hljs-attribute%22%3EDate%3C%2FSPAN%3E%3A%0A%3CSPAN%20class%3D%22hljs-number%22%3E2020%3C%2FSPAN%3E-%3CSPAN%20class%3D%22hljs-number%22%3E12%3C%2FSPAN%3E-%3CSPAN%20class%3D%22hljs-number%22%3E22%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22hljs-number%22%3E10%3C%2FSPAN%3E%3A%3CSPAN%20class%3D%22hljs-number%22%3E54%3C%2FSPAN%3E%3A%3CSPAN%20class%3D%22hljs-number%22%3E43%3C%2FSPAN%3E%0AIP%20%3CSPAN%20class%3D%22hljs-attribute%22%3Eaddress%3C%2FSPAN%3E%3A%0A%3CSPAN%20class%3D%22hljs-attribute%22%3EUser%3C%2FSPAN%3E%3A%0AAAD%20to%20SharePoint%20Sync%0A%3CSPAN%20class%3D%22hljs-attribute%22%3EActivity%3C%2FSPAN%3E%3A%0AThe%20site%20has%20been%20deleted%0A%3CSPAN%20class%3D%22hljs-attribute%22%3EObject%3C%2FSPAN%3E%3A%0A%3CSPAN%20class%3D%22hljs-attribute%22%3Ehttps%3C%2FSPAN%3E%3A%3CSPAN%20class%3D%22hljs-comment%22%3E%2F%2Fsharepint.sharepoint.com%2Fsites%2F***%3C%2FSPAN%3E%0A%3CSPAN%20class%3D%22hljs-attribute%22%3EInformation%3C%2FSPAN%3E%3A%3C%2FPRE%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2009156%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ESharePoint%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESharePoint%20Online%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESharePoint%20Online%20Office%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2009653%22%20slang%3D%22en-US%22%3ERe%3A%20AAD%20to%20SharePoint%20Sync%20deleted%20the%20website%20twice%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2009653%22%20slang%3D%22en-US%22%3ESounds%20like%20a%20policy%20for%20closure%20and%20deletion.%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Foffice%2Fuse-policies-for-site-closure-and-deletion-a8280d82-27fd-48c5-9adf-8a5431208ba5%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Foffice%2Fuse-policies-for-site-closure-and-deletion-a8280d82-27fd-48c5-9adf-8a5431208ba5%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2009727%22%20slang%3D%22en-US%22%3ERe%3A%20AAD%20to%20SharePoint%20Sync%20deleted%20the%20website%20twice%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2009727%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3CBR%20%2F%3E%3CBR%20%2F%3EThe%20issue%20was%20because%20Someone%20had%20created%20a%20Team%20from%20the%20Sharepoint%20Team%20banner%2C%20then%20tried%20to%20delete%20the%20team%20and%20when%20they%20do%20that%20the%20linked%20AD%20group%20got%20deleted%20as%20well%20which%20is%20why%20the%20deletion%20of%20SharePoint%20showed%20up%20as%20%22AAD%20to%20SharePoint%20Sync%22.%20Doing%20and%20Audit%20for%20%22Deleted%20team%22%20reveled%20who%20made%20and%20deleted%20the%20team.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor
Today that one of our SharePoint sites was deleted for a second time, the first deletion was done yesterday and both without warning. I checked the deleted items section of the O365 SharePoint Admin site and there it was and i restore it back and it started working again. Anyone got any suggestions as to why this happens? the site has been working for several Months.


Looking at audit logs on protection.office.com revealed that the site was deleted by AAD to SharePoint Sync which and nothing more

Date:
2020-12-22 10:54:43
IP address:
User:
AAD to SharePoint Sync
Activity:
The site has been deleted
Object:
https://sharepint.sharepoint.com/sites/***
Information:
3 Replies
best response confirmed by michaelsjodin (Contributor)
Solution

Hi

The issue was because Someone had created a Team from the Sharepoint Team banner, then tried to delete the team and when they do that the linked AD group got deleted as well which is why the deletion of SharePoint showed up as "AAD to SharePoint Sync". Doing and Audit for "Deleted team" reveled who made and deleted the team.

Hi, a classic (and twice!) :) I just assumed that wasn’t the case. You should set up activity alerts for these scenarios.