SharePoint Document Issues

How to Investigate and Fix Unexpected SharePoint File Deletions

Maira Mehtab Sep 28, 2026 869 views

Question details

The user needs to determine the root cause of a massive, sudden deletion of SharePoint files attributed to a user who did not perform the action.

Product: Microsoft SharePoint and OneDrive
Device & OS: not provided
Scenario: Thousands of synchronized SharePoint files were deleted within minutes. Standard Microsoft Purview audit searches are showing no results.
Observed behavior: Files are missing from SharePoint and the deletion is attributed to an inactive user. Some of the deleted files are unexpectedly appearing in another user's local desktop recycle bin.

Before you start

Immediately halt any ongoing OneDrive synchronization on affected devices by disconnecting them from the network, and avoid emptying any SharePoint or local device Recycle Bins to preserve crucial forensic evidence.

Solution 1Recommended

Preserve Evidence and Investigate OneDrive Synchronization

Securing recycle bin data and checking local OneDrive sync clients is the most critical first step to halt further deletions and understand the source.

Mass deletions attributed to offline users are frequently caused by local OneDrive sync clients processing offline changes or malfunctioning, then syncing those deletions to SharePoint once connected.

Pause OneDrive Sync

On the affected users' devices, click the OneDrive cloud icon in the taskbar, click the gear icon (Help & Settings), and select 'Pause syncing' to prevent further mass deletions.

Inspect Local Recycle Bins

Open the desktop Recycle Bin on the devices of all users who have access to the affected SharePoint folders. Look for the missing files here, as files deleted via local sync will often land in the local device's bin.

Document Timestamps and Metadata

Take screenshots of the deleted files in both the local and SharePoint Recycle Bins. Note the exact deletion timestamps and the original file paths to establish a timeline of the incident.

Do Not Restore Immediately: Wait to restore the files until you have fully documented the incident and isolated the device causing the deletions, otherwise the sync client may simply delete them again.

Solution 2

Analyze SharePoint Deletion Logs and Audit Information

Use Microsoft 365 administrative tools to track session data and connected applications that might have triggered the mass deletion.

Free Microsoft Office alternative

Try WPS Office for Secure and Reliable Document Management

If you are looking for a reliable, lightweight, and highly compatible alternative to Microsoft Office, WPS Office offers a complete suite for your document needs. It provides seamless offline and cloud storage options without the complex, hidden sync conflicts that can lead to unexpected data loss.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install WPS Office: Run the downloaded executable file and follow the on-screen instructions to quickly install the software.
3. Open Your Files: Launch WPS Office and open your existing Microsoft Office documents effortlessly, maintaining perfect layout and format compatibility.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight installation with fast performance and flexible sync controls.Built-in local backup features to help prevent unexpected file loss.Free to use with a familiar, user-friendly interface for easy migration.

microsoft office alternative - wps office

Frequently Asked Questions

Why would SharePoint files show as deleted by a user who wasn't working at the time?

This usually happens when a local OneDrive sync client on that user's device processes a deletion or file move while offline, and then automatically synchronizes those changes to the SharePoint server as soon as the device reconnects to the internet.

Can I recover mass deleted files if they are not in the primary SharePoint Recycle Bin?

Yes. Check the Second-Stage (Site Collection) Recycle Bin at the bottom of the primary Recycle Bin page. If the files are missing there as well, a Microsoft 365 Administrator can request a point-in-time restoration from Microsoft Support within 14 days of the deletion.

Why is the Microsoft Purview audit search showing no results for these deletions?

Audit logs can experience ingestion delays. Additionally, if the deletion was triggered by a background system process, a specific third-party API, or an unusual sync malfunction, it might bypass standard user-level logging. Microsoft Support can access deeper backend logs to find the missing records.

How can I prevent OneDrive from mass deleting SharePoint files in the future?

Microsoft 365 admins should configure 'Mass deletion' alert policies in the Microsoft Defender portal to catch these actions early. End-users should also ensure they choose 'Free up space' rather than actively deleting synced files if they only wish to remove local copies.

Document & File Issues