Files being deleted by System Account SharePoint Online

[Hilary Stoupa]

Starting late July, I've had items deleted from libraries in our root SharePoint Online site as well as subsites by "System Account". We've checked various Flows (but with the delete coming from System Account, that seems unlikely, as well as the number of libraries involved). This appears to be happening every 5 to 6 days, and the files deleted are those that aren't modified frequently (I noticed because a spreadsheet I update once a month keeps getting deleted).

We don't appear to be using any records management features - I checked a couple of the libraries and no policies seem to be set under Information Policy Management. Also, because this is happening on so many subsites & libraries, it seems like it must be something at the site level.

I also took a look at protection.office.com to see if there was anything there.... Clicking on Records Management category on the sidebar just toggles the up/down arrow and doesn't navigate anywhere.

[#2]

@Hilary Stoupa Could you please confirm you have verified the retention policy check in SharePoint online admin center.

To check that please follow the link: https://docs.microsoft.com/en-us/office365/securitycompliance/retention-policies

Another helpful link is : https://sharepointmaven.com/set-retention-deletion-policies-files-folders-sharepoint/

[#3]

Probably a retention policy configured in the Security and Compliance center? What does the Audit log show for such events?

[#4]

@Vasil Michev Can you tell me where to find the Audit Log for SharePoint Online?

[#5]

@Vikram_Samal Can you tell me where I should go to check this? I'm sorry - I'd already read the linked article prior to posting, but I am having trouble figuring out where to find these settings in the SharePoint Online Admin Center - did I overlook this in the article? I'm assuming this is an organization wide policy of some kind (though none of my colleagues recall configuring one...)

[#6]

Both things are not in the SPO Admin Center, you will find them in the Security & Compliance Center

[#7 · Accepted solution]

Click here: https://protection.office.com/unifiedauditlog

And the documentation is here: https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-c...

[#8]

@Vasil Michev Thank you so much. One of my colleagues had indeed implemented a data retention policy, that I could not see - the Audit Log showed me that is what is deleting documents.