I'm trying to figure out who is deleting specific files for a user in OneDrive. Does anyone have a script that effectively shows who deleted what during a specified date range? I've tried a few I found online, but they don't seem to work within our MS365 tenant.
5 Answers
Also, don't forget to check the primary and secondary recycling bins in OneDrive! They can show who deleted files, which could be useful information for you.
Just to add, keep in mind that only certain people can delete files in OneDrive—typically just the user, admins, and those with specific permissions.
You should check out the audit log in Purview. It's probably the simplest way to see delete actions. Just a heads up, the queries can be a bit tricky to figure out at first.
If you have access to Purview, it's super straightforward. Just remember, you need the Security Reader admin role to get going with it.
It's definitely risky to run scripts from the internet on your production tenant without knowing exactly what they do. Instead, I'd recommend looking into the audit log—that doesn't require PowerShell and can track file deletions.
Thanks for the suggestion!