SharePoint Document Issues

How to Find Deleted SharePoint Files Missing from Audit Logs

Natalie Taylor Oct 10, 2026 869 views

Question details

The user is attempting to locate audit logs for a deleted SharePoint folder, but the deletion event does not appear in standard activity details or audit log searches.

How to Find Deleted SharePoint Files Missing from Audit Logs

Product: Microsoft SharePoint
Device & OS: not provided
Scenario: Investigating a deleted file or folder in SharePoint and searching the compliance audit logs to track the deletion activity.
Observed behavior: The deletion event is completely missing from the audit search results, making it impossible to identify who deleted the item or when it occurred.

Before you start

Ensure you have administrative privileges for the Microsoft Purview compliance portal and confirm that auditing was actively enabled for your organization before the deletion occurred.

Solution 1Recommended

Verify Audit Settings and Adjust Search Criteria

Ensure that your search parameters are correct and that the event falls within your organization's data retention policy.

Audit logs rely heavily on specific search criteria and default retention limits. If a file was deleted outside the standard retention window (usually 180 days for default licenses), the log will no longer be available. Adjusting your filters can help uncover missed events.

Access Microsoft Purview

Navigate to Audit Search

On the left-hand navigation pane, select 'Audit' to open the audit log search tool.

Refine the Date Range

Adjust the 'Start date' and 'End date' to generously cover the period when you suspect the file or folder was deleted.

Filter by Specific Event Type

Click the 'Activities' dropdown menu, search for 'Deleted file or folder', and select it. Leave other activities unselected to avoid cluttering the results.

Verify Audit Settings and Adjust Search Criteria

Auditing Must Be Pre-enabled: If audit logging was not enabled prior to the file being deleted, Microsoft 365 will not retroactively generate logs for that deletion event.

Solution 2

Open a Microsoft 365 Support Request

If the deletion log is still missing, Microsoft Support can investigate backend SharePoint logs that are inaccessible to tenant administrators.

Free Microsoft Office alternative

Simplify Your Document Management with WPS Office

Dealing with complex SharePoint configurations, audit log limits, and compliance portals can be overwhelming. If you need a straightforward, free alternative for daily document creation and local management, WPS Office offers a seamless experience without the enterprise overhead.

1. Download the Installer: Visit the official WPS website to download the free installation package for your Windows, Mac, or Linux device.
2. Install WPS Office: Run the downloaded file and follow the simple on-screen instructions to complete the setup in minutes.
3. Open and Edit Your Files: Launch WPS Office and immediately start opening your existing Microsoft Office documents with complete format preservation.

Fully compatible with Microsoft Word, Excel, and PowerPoint formatsLightweight installation ensuring fast startup and smooth operationFree Microsoft Office alternative with no mandatory subscriptionsIntuitive, tabbed interface that makes local document management simpler than SharePoint

microsoft office alternative - wps office

Frequently Asked Questions

Why did my deleted SharePoint file bypass the audit log entirely?

The audit log might miss a deletion if auditing was turned off at the time of the event, the event fell outside your data retention limits, the wrong search filters were applied, or there was a temporary Microsoft service incident impacting data collection.

How long are SharePoint audit logs retained by Microsoft 365?

By default, Microsoft 365 retains audit logs for 180 days for standard licenses. If your organization has an E5 license or has configured Microsoft 365 Advanced Auditing, logs can be retained for up to one year or longer based on custom retention policies.

Can I recover a deleted SharePoint file even if it's missing from the audit log?

Yes. The audit log tracks user activity, but file recovery relies on the Recycle Bin. You can typically restore deleted items from the SharePoint site's first-stage Recycle Bin or the Second-stage recycle bin (Site Collection Recycle Bin) within 93 days of deletion.

Document & File Issues