Reports/Logs for content being deleted using Retention Policies, Labels, Document Deletion Policies?

[Suraj Padhy]

Hi,

I am trying to leverage the delete action in Retention policies, labels and document deletion policies to delete aged content in SharePoint & ODFB environment. On reading through the docs around these features, these pretty much serve the purpose, however I couldn't find any reporting/logging specific to these features. 

Basically, looking for logs/reports on what content is specifically being deleted due to implementation of these policies

Will this information be logged in Audit logs in O365  Security & Compliance center or is it possible to build reports based on any built in APIs that provide this info ?

Appreciate your inputs/thoughts on this !

[#2]

Nothing is logged, as those are automated processes. And especially in the case of email, this can affect literally thousands of hundreds of items per day in a big organization, so I doubt you will want to go over all of these. For SharePoint/OneDrive content you can use the Disposition review fucntionality: https://support.office.com/en-us/article/overview-of-disposition-reviews-d0c6095b-bfee-4906-a2c7-89c...

There's some basic reporting available via Get-DataRetentionReport.

[#3]

I'm not sure what Get-DataRetentionReport actually tells you... 

In any case, Disposition Review works well. See https://www.petri.com/office-365-disposition-reviews 

[#4]

@Vasil Michev We have helped a customer turn on retention policies for their SharePoint file storage.  We have some users questioning why some files have been deleted automatically as the retention policy dictates.  The questioning comes in because the user believes that they have not applied the tag to these files.  We have used the Unified Audit Log to validate things and we see that no retention label was attached to the file and the System Account deleted it.-  It would be really handy to see an audit log of deleted files by the retention process so that we could eliminate retention as a reason the file was deleted.  Is there a report that would do this now?  It has been a couple of years since this post was launched.  Thanks.

[#5]

Additional info to this issue. In the Unified Audit Log, we are seeing the same System Account that deleted the item also performed activity "changed retention label for a file" about 7 minutes prior to the file being deleted. Any ideas what automated process would change a retention label?

[#6]

Hi All,

We have similar requirements as @Tom Nohelty mentioned already when it comes to Cloud Compliance and Governance.

Compliance Guys like to verify, if their Compliance Settings (based on Retention Policies) are working and we have to prove, that the Data is deleted, when the Retention Time is over...

Would be really great to get some insights about logs, when the retention policy kicks in and deletes data at companies. Truly wishful for large Enterprises with heavy Compliance. 

Any Feedback is welcome to solve such requests.

Thanks and best regards,

Martin 

[#7]

All,
Similar to the previous inquiries, I am looking for a way to report on content that will be coming up for deletion due to label expiration and due to a general policy that will auto delete content after a period of time if it is not labeled. I am not configuring under records management but using retention labels and a policy only. Any help on how to access/configure logs or data would be greatly appreciated.

[#8]

@Tom Nohelty in the Audit logs in column AuditData look for "UserType":7 - refer to https://learn.microsoft.com/en-us/purview/audit-log-detailed-properties#usertype-and-userkey-scenari... it means a custom retention policy deleted the file