Find all Deletion Events in SharePoint Online

If you need to quickly find out who deleted what and when in SharePoint Online, you can use the Audit log search feature in the Microsoft 365 Purview portal (or Microsoft Compliance Center if you still see it). This feature allows you to search for specific activities, including file and folder deletions, across your SharePoint Online sites.

Audit Log in Microsoft 365 Purview

• Navigate to the Microsoft 365 Purview portal.
• Solutions > Audit

• Use the “File, folder, or site” filter to narrow down the search to specific SharePoint sites or libraries.
• Click on the “Search” button to initiate the search.
• Optionally, in the “Activities” filter, select “Recycled file” and “Recycled folder” to focus on deletion events.

💡 Always use the wildcard at the end of the url. Otherwise, the activities might not be filtered properly

• After 2-15 minutes, the search results will be available in the “Search results” section.
• Click on the latest search result

• Export the results for further analysis or record-keeping.

• Alternatively, click Filter to filter the results by specific activities, such as “Recycled File” and “Recycled Folder”:

💡 The filter section needs the full, exact names of the activities that are comma separated. For example Recycled File,Recycled Folder

Delete Activities Naming Convention

Notice that the deletion events are not called “Deleted” but “Recycled”. Back in approximately 2023, Microsoft changed the terminology from “Deleted” to “Recycled” in the audit log search. This change was made to align with the terminology used in the SharePoint Recycle Bin.