Aug 26 2019 08:32 AM
Aug 26 2019 08:32 AM
Starting late July, I've had items deleted from libraries in our root SharePoint Online site as well as subsites by "System Account". We've checked various Flows (but with the delete coming from System Account, that seems unlikely, as well as the number of libraries involved). This appears to be happening every 5 to 6 days, and the files deleted are those that aren't modified frequently (I noticed because a spreadsheet I update once a month keeps getting deleted).
We don't appear to be using any records management features - I checked a couple of the libraries and no policies seem to be set under Information Policy Management. Also, because this is happening on so many subsites & libraries, it seems like it must be something at the site level.
I also took a look at protection.office.com to see if there was anything there.... Clicking on Records Management category on the sidebar just toggles the up/down arrow and doesn't navigate anywhere.
Aug 26 2019 09:09 AM
@Hilary Stoupa Could you please confirm you have verified the retention policy check in SharePoint online admin center.
To check that please follow the link: https://docs.microsoft.com/en-us/office365/securitycompliance/retention-policies
Another helpful link is : https://sharepointmaven.com/set-retention-deletion-policies-files-folders-sharepoint/
Aug 26 2019 09:10 AM
Probably a retention policy configured in the Security and Compliance center? What does the Audit log show for such events?
Aug 26 2019 09:50 AM
@Vasil Michev Can you tell me where to find the Audit Log for SharePoint Online?
Aug 26 2019 09:54 AM
@Vikram_Samal Can you tell me where I should go to check this? I'm sorry - I'd already read the linked article prior to posting, but I am having trouble figuring out where to find these settings in the SharePoint Online Admin Center - did I overlook this in the article? I'm assuming this is an organization wide policy of some kind (though none of my colleagues recall configuring one...)
Aug 26 2019 10:38 AM
Aug 26 2019 10:48 AMSolution
Click here: https://protection.office.com/unifiedauditlog
And the documentation is here: https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-c...
Aug 26 2019 11:56 AM
@Vasil Michev Thank you so much. One of my colleagues had indeed implemented a data retention policy, that I could not see - the Audit Log showed me that is what is deleting documents.