Permission & Access Issues

How to Investigate Unauthorized Removal of Microsoft List Permissions

Maira Mehtab Sep 22, 2026 869 views

Question details

An administrator needs to identify the root cause of access permissions being unexpectedly removed from a Microsoft List for a co-owner and domain group.

Product: Microsoft Lists
Device & OS: not provided
Scenario: Investigating the unauthorized removal of access permissions in Microsoft 365.
Observed behavior: Access permissions for a co-owner and a domain group were stripped without manual authorization, requiring the administrator to manually restore them.

Before you start

Ensure you have global administrator or SharePoint administrator rights in your Microsoft 365 tenant to access the Microsoft Purview compliance portal and view audit logs.

Solution 1Recommended

Review Microsoft Purview Audit Logs

Identify the exact user or automated process that modified the list permissions by checking the tenant's audit logs.

Access Microsoft Purview

Navigate to Audit

Select the 'Audit' section from the left-hand navigation pane to open the audit search tool.

Search for Activities

Set the date range to the period when the permissions were removed, and search for specific activities such as 'Changed site permissions' or 'Modified list permissions' to identify the source of the change.

Solution 2

Inspect Power Automate Flows and Policies

Check for automated workflows or tenant policies that might have inadvertently stripped permissions from the list.

Solution 3

Open a Microsoft 365 Support Ticket

If audit logs and automated workflows do not reveal the source of the permission changes, contact Microsoft Support for advanced backend diagnostics.

Free Microsoft Office alternative

Simplify Your Document Management with WPS Office

Managing complex enterprise permissions in Microsoft Lists can be challenging and time-consuming. For straightforward document, spreadsheet, and presentation management, WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Office. Enjoy seamless offline and online editing without the complicated administrative overhead.

1. Download WPS Office: Go to the official WPS website and download the free installation package.
2. Install the Software: Run the installer and follow the simple prompts to set up WPS Office on your computer.
3. Start Creating: Open your existing Microsoft files or create new documents, spreadsheets, and presentations instantly.

Fully compatible with Microsoft Excel, Word, and PowerPoint formatsFree and lightweight alternative to heavy enterprise suitesIntuitive interface that requires zero learning curveEasy local and cloud file sharing without complex permission hurdles

microsoft office alternative - wps office

Frequently Asked Questions

Can Power Automate workflows change Microsoft List permissions automatically?

Yes. If a Power Automate flow is configured with actions like 'Stop sharing an item' or 'Grant access', it can automatically add or remove permissions from a list or list items based on its specific automated triggers.

How long are audit logs kept in Microsoft Purview to investigate permission changes?

By default, Microsoft Purview retains audit logs for 180 days for standard enterprise licenses, giving administrators a generous window to investigate unexpected permission changes. Premium licenses may offer longer retention policies.

Why would a domain group lose access to a Microsoft List unexpectedly?

This can happen due to accidental manual removal by another co-owner, automated scripts running in the background, changes to site-level external sharing policies, or synchronization issues with Azure Active Directory.

Document & File Issues