{"id":1802,"date":"2025-11-10T00:30:53","date_gmt":"2025-11-10T00:30:53","guid":{"rendered":"https:\/\/www.ultrexstaff.com\/?p=1802"},"modified":"2025-11-10T00:30:53","modified_gmt":"2025-11-10T00:30:53","slug":"how-to-track-down-who-deleted-a-sharepoint-site-in-microsoft-365","status":"publish","type":"post","link":"https:\/\/www.ultrexstaff.com\/?p=1802","title":{"rendered":"How to track down who deleted a SharePoint site in Microsoft 365"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">How to track down who deleted a SharePoint site in Microsoft 365<\/h1>\n\n\n\n<p>Raised from ticket #2838<\/p>\n\n\n\n<p>If you need to find out who deleted a SharePoint site in Microsoft 365, follow these steps:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step-by-Step Instructions<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Sign in to the Microsoft 365 Admin Center:<\/strong>\u00a0Go to\u00a0<a href=\"https:\/\/admin.microsoft.com\/\">admin.microsoft.com<\/a>.<\/li>\n\n\n\n<li><strong>Access the Compliance Section:<\/strong>\u00a0In the left navigation pane, go to\u00a0<strong>Compliance<\/strong>\u00a0>\u00a0<strong>Audit<\/strong>.<\/li>\n\n\n\n<li><strong>Search the Audit Logs:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Click on\u00a0<strong>Search<\/strong>\u00a0to open the audit log search.<\/li>\n\n\n\n<li>Specify the date range when the deletion occurred.<\/li>\n\n\n\n<li>Select activities related to\u00a0<strong>Deleted site collection<\/strong>\u00a0or simply search for\u00a0<strong>delete<\/strong>.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Review the Results:<\/strong>\u00a0Click on\u00a0<strong>Search<\/strong>\u00a0and wait for the results to populate. Look for the following details:\n<ul class=\"wp-block-list\">\n<li><strong>Timestamp:<\/strong>\u00a0When the deletion occurred.<\/li>\n\n\n\n<li><strong>User:<\/strong>\u00a0Who performed the deletion.<\/li>\n\n\n\n<li><strong>Activity:<\/strong>\u00a0Confirm it was a\u00a0<strong>Deleted site collection<\/strong>.<\/li>\n\n\n\n<li><strong>Item:<\/strong>\u00a0The URL of the deleted site.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Download Results (Optional):<\/strong>\u00a0If needed, download the results as a CSV for further analysis.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Restoring a Recently Deleted Site<\/h2>\n\n\n\n<p>If the site was deleted within the last 93 days, you can restore it:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to the\u00a0<strong>SharePoint Admin Center<\/strong>.<\/li>\n\n\n\n<li>Select\u00a0<strong>Deleted sites<\/strong>.<\/li>\n\n\n\n<li>Locate the site and click\u00a0<strong>Restore<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p><strong>Note:<\/strong>&nbsp;Sites are permanently deleted after 93 days, so act quickly if restoration is needed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Common Issues<\/h2>\n\n\n\n<p>If you encounter issues accessing the audit logs, ensure you have the correct role, such as Audit logs viewer, Compliance Admin, or Global Admin. Additionally, verify that audit logging is enabled in Microsoft Purview.<\/p>\n\n\n\n<p>By following these steps, you should be able to identify who deleted the SharePoint site and take appropriate action.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>How to track down who deleted a SharePoint site in Microsoft 365 Raised from ticket #2838 If you need to find out who deleted a SharePoint site in Microsoft 365, follow these steps: Step-by-Step Instructions Restoring a Recently Deleted Site If the site was deleted within the last 93 days, you can restore it: Note:&nbsp;Sites [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[98,117],"tags":[],"class_list":["post-1802","post","type-post","status-publish","format-standard","hentry","category-it-knowledge-base-articles","category-ms365","post-preview"],"_links":{"self":[{"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/1802","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1802"}],"version-history":[{"count":1,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/1802\/revisions"}],"predecessor-version":[{"id":1803,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/1802\/revisions\/1803"}],"wp:attachment":[{"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1802"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1802"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1802"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}