logo
search
OneDrive File Issues

How to Fix OneDrive Audit Log Showing Wrong User for Deleted Folder

Muhammad TalhaMuhammad Talha Sep 30, 2026 868 views

Question details

The user needs to understand why the OneDrive or SharePoint audit log incorrectly shows their name for a deleted folder they did not delete, and how to resolve this attribution error.

How to Resolve OneDrive Audit Log Showing the Wrong User for a Deleted Folder
Product
Microsoft OneDrive and SharePoint Online
Device & OS
not provided
Scenario
Reviewing OneDrive or SharePoint activity logs and finding an unexpected folder deletion attributed to the wrong user.
Observed behavior
A OneDrive or SharePoint folder appears in the activity log or audit record as deleted by a specific user, despite that user not performing the deletion or moving the folder.
Before you start

Verify if the folder was accidentally moved rather than deleted, as moving a folder removes it from its original location and logs it as a deletion in the activity pane.

Solution 1

Verify if the Folder Was Moved Instead of Deleted

Rule out the possibility of a move operation, which automatically logs as a deletion at the source location.

In OneDrive and SharePoint, moving a file or folder deletes it from its original location and places it in the new location. This action generates a deletion record in the audit log under the name of the user who moved it.

1
Search for the folder

Use the search bar at the top of your OneDrive or SharePoint site to search for the exact name of the missing folder.

2
Check the new path

If the folder appears in the search results, check its current file path to see if it was accidentally dragged and dropped into another directory.

Free Microsoft Office alternative

Experience Reliable Document Management with WPS Office

While resolving OneDrive backend audit log issues requires Microsoft support intervention, you can streamline your daily work by switching to WPS Office. It offers a free, lightweight, and highly compatible alternative to Microsoft Office, ensuring seamless document management without heavy administrative burdens.

  1. 1. Download the installer: Visit the official WPS Office website and click the Free Download button for your operating system.
  2. 2. Install the software: Run the downloaded installer file and follow the on-screen prompts to set up WPS Office on your device.
  3. 3. Open and edit files: Launch WPS Office and directly open your existing Microsoft Office documents to continue working without formatting issues.
Highly compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx)Lightweight software that runs smoothly on Windows, Mac, Linux, and mobile devicesBuilt-in cloud storage for secure, transparent, and easy document backupFree to use with a familiar, user-friendly interface that requires zero learning curve
microsoft office alternative - wps office

Frequently Asked Questions

Can moving a folder in OneDrive look like a deletion in the audit log?

Yes. When you move a file or folder in OneDrive for Business or SharePoint Online, it is deleted from its original location and placed in the new one. This action automatically generates a deletion record in the activity pane and audit log under the user who moved it.

Can I open a support ticket with Microsoft directly to check the logs?

Typically, no. Administrator privileges are required to create a support ticket in the Microsoft 365 admin center. If you are an end-user, you must contact your organization's IT administrator to open the service request on your behalf.

Can Microsoft community moderators access my backend audit logs to clear my name?

No, community forum moderators do not have access to your organization's backend audit data or tenant server logs. Only Microsoft's official development and backend support teams can securely investigate these records.