How to Fix OneDrive Audit Log Showing Wrong User for Deleted Folder
Question details
The user needs to understand why the OneDrive or SharePoint audit log incorrectly shows their name for a deleted folder they did not delete, and how to resolve this attribution error.

- Product
- Microsoft OneDrive and SharePoint Online
- Device & OS
- not provided
- Scenario
- Reviewing OneDrive or SharePoint activity logs and finding an unexpected folder deletion attributed to the wrong user.
- Observed behavior
- A OneDrive or SharePoint folder appears in the activity log or audit record as deleted by a specific user, despite that user not performing the deletion or moving the folder.
Verify if the folder was accidentally moved rather than deleted, as moving a folder removes it from its original location and logs it as a deletion in the activity pane.
Verify if the Folder Was Moved Instead of Deleted
Rule out the possibility of a move operation, which automatically logs as a deletion at the source location.
In OneDrive and SharePoint, moving a file or folder deletes it from its original location and places it in the new location. This action generates a deletion record in the audit log under the name of the user who moved it.
Use the search bar at the top of your OneDrive or SharePoint site to search for the exact name of the missing folder.
If the folder appears in the search results, check its current file path to see if it was accidentally dragged and dropped into another directory.
Request an M365 Administrator to Open a Service Request
Have your IT administrator escalate the unexpected log behavior to Microsoft support for a deep backend investigation.
Experience Reliable Document Management with WPS Office
While resolving OneDrive backend audit log issues requires Microsoft support intervention, you can streamline your daily work by switching to WPS Office. It offers a free, lightweight, and highly compatible alternative to Microsoft Office, ensuring seamless document management without heavy administrative burdens.
- 1. Download the installer: Visit the official WPS Office website and click the Free Download button for your operating system.
- 2. Install the software: Run the downloaded installer file and follow the on-screen prompts to set up WPS Office on your device.
- 3. Open and edit files: Launch WPS Office and directly open your existing Microsoft Office documents to continue working without formatting issues.

Frequently Asked Questions
Can moving a folder in OneDrive look like a deletion in the audit log?
Yes. When you move a file or folder in OneDrive for Business or SharePoint Online, it is deleted from its original location and placed in the new one. This action automatically generates a deletion record in the activity pane and audit log under the user who moved it.
Can I open a support ticket with Microsoft directly to check the logs?
Typically, no. Administrator privileges are required to create a support ticket in the Microsoft 365 admin center. If you are an end-user, you must contact your organization's IT administrator to open the service request on your behalf.
Can Microsoft community moderators access my backend audit logs to clear my name?
No, community forum moderators do not have access to your organization's backend audit data or tenant server logs. Only Microsoft's official development and backend support teams can securely investigate these records.





