How to track down who deleted a SharePoint site in Microsoft 365

Raised from ticket #2838

If you need to find out who deleted a SharePoint site in Microsoft 365, follow these steps:

Step-by-Step Instructions

1. Sign in to the Microsoft 365 Admin Center: Go to admin.microsoft.com.
2. Access the Compliance Section: In the left navigation pane, go to Compliance > Audit.
3. Search the Audit Logs:
   • Click on Search to open the audit log search.
   • Specify the date range when the deletion occurred.
   • Select activities related to Deleted site collection or simply search for delete.
4. Review the Results: Click on Search and wait for the results to populate. Look for the following details:
   • Timestamp: When the deletion occurred.
   • User: Who performed the deletion.
   • Activity: Confirm it was a Deleted site collection.
   • Item: The URL of the deleted site.
5. Download Results (Optional): If needed, download the results as a CSV for further analysis.

Restoring a Recently Deleted Site

If the site was deleted within the last 93 days, you can restore it:

1. Go to the SharePoint Admin Center.
2. Select Deleted sites.
3. Locate the site and click Restore.

Note: Sites are permanently deleted after 93 days, so act quickly if restoration is needed.

Common Issues

If you encounter issues accessing the audit logs, ensure you have the correct role, such as Audit logs viewer, Compliance Admin, or Global Admin. Additionally, verify that audit logging is enabled in Microsoft Purview.

By following these steps, you should be able to identify who deleted the SharePoint site and take appropriate action.