Reports/Logs for content being deleted using Retention Policies, Labels, Document Deletion Policies?

[Suraj Padhy]

Hi,

I am trying to leverage the delete action in Retention policies, labels and document deletion policies to delete aged content in SharePoint & ODFB environment. On reading through the docs around these features, these pretty much serve the purpose, however I couldn't find any reporting/logging specific to these features. 

Basically, looking for logs/reports on what content is specifically being deleted due to implementation of these policies

Will this information be logged in Audit logs in O365  Security & Compliance center or is it possible to build reports based on any built in APIs that provide this info ?

Appreciate your inputs/thoughts on this !

[#2]

Nothing is logged, as those are automated processes. And especially in the case of email, this can affect literally thousands of hundreds of items per day in a big organization, so I doubt you will want to go over all of these. For SharePoint/OneDrive content you can use the Disposition review fucntionality: https://support.office.com/en-us/article/overview-of-disposition-reviews-d0c6095b-bfee-4906-a2c7-89c...

There's some basic reporting available via Get-DataRetentionReport.

[#3]

I'm not sure what Get-DataRetentionReport actually tells you... 

In any case, Disposition Review works well. See https://www.petri.com/office-365-disposition-reviews 

[#4]

@Vasil Michev We have helped a customer turn on retention policies for their SharePoint file storage.  We have some users questioning why some files have been deleted automatically as the retention policy dictates.  The questioning comes in because the user believes that they have not applied the tag to these files.  We have used the Unified Audit Log to validate things and we see that no retention label was attached to the file and the System Account deleted it.-  It would be really handy to see an audit log of deleted files by the retention process so that we could eliminate retention as a reason the file was deleted.  Is there a report that would do this now?  It has been a couple of years since this post was launched.  Thanks.

[#5]

Additional info to this issue. In the Unified Audit Log, we are seeing the same System Account that deleted the item also performed activity "changed retention label for a file" about 7 minutes prior to the file being deleted. Any ideas what automated process would change a retention label?