How to Find Who Deleted the Files from Microsoft 365

Accidental file deletions are common in collaborative workspaces. Fortunately, accessing the recycle bin simplifies file recovery, eliminating the need for complex data retrieval processes. This prevents permanent data loss caused by human error, ensuring smooth operations and maintaining data integrity. SharePoint's recycle bin offers a straightforward process for recovering deleted files, providing a safety net that supports ongoing productivity and secures essential information.

In Microsoft 365, the recycle bin has two stages for managing deleted files, with a total retention period of 93 days across both stages:

Effective recycle bin management is essential for maintaining a clutter-free digital environment. This involves key operations such as accessing the recycle bin, restoring files to their original locations, and ensuring the permanent deletion of unnecessary files.

How to Access Files from the Recycle Bin?

How to Restore Files from the Recycle Bin?

How to Delete Files Permanently from the Recycle Bin?

Automating recycle bin management simplifies digital maintenance by making tasks like purging outdated files effortlessly. This not only saves time but also keeps your digital space organized and optimized for performance.

Retention Policy

Implementing a retention policy is essential for managing the documents lifecycle. It ensures that important files are not accidentally deleted or permanently removed too soon, while also automating the clean-up of outdated files.

• Identify potential risks by tracking the permanent deletion of SharePoint files via scripts, user-initiated deletions of OneDrive files, and deletions of folders across both platforms.
• This section will provide you with reports that track File Deletions, File Restorations, File Version Changes, Folder Deletions, and Folder Restorations.

Unauthorized file deletions may occur due to human error, malicious intent, or compromised accounts. By implementing measures to prevent unauthorized file deletion, you can safeguard your organization's valuable data and maintain control over document integrity.

Regularly auditing file access is essential for preventing unauthorized file deletion by ensuring only relevant users have appropriate permissions.

With the details from the audit search, implement the appropriate access control and permissions. Remember to break inheritance before making any changes to users' permissions, and ensure that you periodically review custom permissions granted to document libraries.

Assign custom permission levels to desired site visitors and members based on their requirements and role scope to avoid unauthorized deletions.

Limit external sharing to users belonging to pre-defined, trusted domains and require all external users accessing shared content to undergo sign-in verification.

Allowing sharing with specific domains and limiting external sharing enhances data security, ensuring content is only shared with trusted external parties.

• Admins can view the SharePoint file access history of a specific user by filtering the data.
• Use the built-in charts available in the report to gain insights on top accessed files, users who access files frequently, and more.

Imagine an audit is underway at your company, with all critical financial records stored in SharePoint. During this crucial time, if an important financial report is accidentally deleted and isn't promptly discovered, the audit process could be delayed. This could potentially lead to compliance violations and financial issues. Implementing real-time alerts for file deletions are essential for quickly detecting and addressing such incidents, to avoid data loss and ensure smooth business operations.

Even better, AdminDroid's Alert feature lets you create alert policies directly from the report with just two clicks.

• Create Alert Policies: Simply click the bell icon on any report page to set up alert policies.
• Fine-Tune Alerts: Use the alert preview console to tweak policies and set thresholds easily.
• Manage Alerts Efficiently: Edit settings and update alert status to open, closed, or investigating in the Alerts section.

• Prebuilt Alert Policies: Take advantage of pre-built policies to monitor unusual amounts of file deletions.
• Alerts Dashboard: Monitor all alerts in one centralized dashboard for quick insights.
• Alerts Reports: Access detailed reports that track all alert activities for comprehensive monitoring.

AdminDroid makes it easy to enhance your file deletion monitoring beyond the native capabilities of Microsoft 365.

Understanding who deleted files from Microsoft 365 is crucial for several reasons. Whether it's to maintain data integrity, enforce security protocols, or conduct investigations into unauthorized access, identifying the responsible user provides valuable insights for effective governance and risk management.