OneDrive File Issues

How to Track OneDrive Folder Deletion and Restoration Activity

Maira Mehtab Sep 22, 2026 869 views

Question details

Users or administrators need to investigate and track when specific folders were deleted, restored, or accessed in OneDrive.

Product: Microsoft OneDrive
Device & OS: not provided
Scenario: Investigating file or folder activities to identify potential unauthorized access, accidental deletions, or restoration events.
Observed behavior: Administrators require detailed activity logs and reports to verify folder history and ensure account security.

Before you start

Ensure you have Microsoft 365 administrator privileges, as accessing comprehensive OneDrive activity reports and sign-in logs requires administrative access.

Solution 1Recommended

Review OneDrive Activity Reports in Microsoft 365 Admin Center

Use the Microsoft 365 admin center to generate and review comprehensive activity reports for OneDrive to track deletions and restorations.

Microsoft 365 provides built-in audit capabilities that allow administrators to track user activities, including file and folder deletions, restorations, and access events across OneDrive for Business.

Access the Admin Center

Navigate to Reports

In the left-hand navigation menu, click on 'Reports' and then select 'Usage' to view organizational activity.

View OneDrive Activity

Locate and click on the 'OneDrive for Business' activity section. From here, you can filter and export reports to investigate specific folder deletion, restoration, or access activities.

Admin Privileges Required: If you are a standard user and cannot access the admin center, you must contact your organization's IT department to request an activity report.

Solution 2

Investigate Unauthorized Access and Secure the Account

If you suspect a folder was deleted or accessed without authorization, take immediate steps to review sign-in activity and secure the account.

Free Microsoft Office alternative

Experience Lightweight and Secure File Management with WPS Office

While Microsoft 365 offers extensive administrative tracking for OneDrive, everyday users often prefer a simpler, faster, and more intuitive document editing experience. WPS Office is a powerful, free alternative to Microsoft Office that easily integrates with cloud storage services, providing a seamless and familiar interface for managing your work.

1. Download and Install: Visit the official WPS Office website to download the free application for your PC, Mac, or mobile device.
2. Connect Cloud Storage: Open WPS Office, navigate to the 'Open' menu, and link your preferred cloud storage accounts.
3. Edit and Save Seamlessly: Access your documents, edit them with rich formatting tools, and save them back to the cloud with perfect compatibility.

Fully compatible with Microsoft Office file formats (.docx, .xlsx, .pptx).Seamlessly connect and edit files directly from third-party cloud storage.Lightweight architecture ensures fast loading and smooth performance on all devices.Free to use with a user-friendly interface that requires no steep learning curve.

microsoft office alternative - wps office

Frequently Asked Questions

Can regular users view detailed OneDrive deletion activity?

Regular users can view basic version history and check the Recycle Bin for deleted files, but comprehensive activity logs showing exactly when and by whom a folder was deleted require Microsoft 365 administrator privileges.

How long are OneDrive activity reports retained?

By default, Microsoft 365 retains audit logs and activity reports for a specific period, typically 90 days for standard enterprise licenses, though this can vary depending on your organization's specific subscription plan and retention policies.

What should I do if I discover unauthorized access in my sign-in logs?

You should immediately change your password, enable multifactor authentication (MFA) from your account security settings, and notify your IT administrator so they can secure the account and investigate further.

Document & File Issues