Deleted File Recovery

How to Investigate Deleted Files in a SharePoint Online Site

Tauseeq Magsi Oct 9, 2026 868 views

Question details

An administrator needs to determine the root cause of files unexpectedly disappearing or being sent to the recycle bin in a SharePoint Online site.

How to Investigate Deleted Files in a SharePoint Online Site

Product: SharePoint Online / Microsoft 365
Device & OS: not provided
Scenario: Files in a SharePoint site are missing or found in the recycle bin without any known manual deletion by the site users.
Observed behavior: Files are being deleted automatically from the site, which may be triggered by underlying compliance processes, retention policies, or unrecorded user activities.

Before you start

You must have Microsoft 365 administrator privileges to access the Purview compliance portal, check active retention policies, and view the organization's audit logs.

Solution 1Recommended

Verify Data Lifecycle Management Retention Policies

Check if an automated retention policy is causing the files to be deleted after a certain period of time.

SharePoint Online and OneDrive do not typically delete files automatically. However, automated retention policies set by an organization's compliance team can force data to be deleted once it reaches a certain age limit.

Access the Compliance Portal

Navigate to Data Lifecycle Management

In the left-hand navigation pane, select 'Data lifecycle management'.

Open Policy Lookup

Click on 'Microsoft 365', and then select the 'Policy Lookup' tab from the top menu.

Search by Site URL

Select 'Site' as the location type, enter the exact URL of the affected SharePoint site, and click 'Search'.

Review the Policies

Review the search results to see if any active retention policy applies to the site that explains the automated file deletion.

Verify Data Lifecycle Management Retention Policies

Policy adjustments: If you discover a policy is overly restrictive, you may need to work with your compliance team to adjust the retention period for that specific site.

Solution 2

Search the Microsoft 365 Audit Log for Site Activity

If no retention policy explains the deletions, use the audit log to track specific user or system actions that resulted in the files being deleted.

Free Microsoft Office alternative

Looking for a Simpler Way to Manage Team Documents?

While Microsoft 365 offers extensive enterprise compliance tools, they can be complex to navigate and manage. If you are looking for a straightforward, highly compatible office suite, WPS Office provides a free, lightweight alternative with built-in cloud storage and intuitive document collaboration features.

1. Download WPS Office: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install and Launch: Run the installer and follow the simple on-screen instructions to set up the software.
3. Open Your Office Files: Sign in to your account and seamlessly open, edit, and collaborate on any Microsoft Office file format with zero formatting loss.

Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Free and lightweight alternative to complex Microsoft 365 admin environments.Built-in WPS Cloud storage with straightforward version history and easy file recovery.Familiar, user-friendly interface that requires zero learning curve for your team.

microsoft office alternative - wps office

Frequently Asked Questions

Can files in SharePoint Online be deleted automatically without a retention policy?

Generally, SharePoint Online does not delete files on its own. If no retention policy is active, the deletion is likely caused by a user's manual action, an unintended synchronization issue via the OneDrive desktop client, or a third-party application with permissions to manage site files.

How long are deleted files kept in the SharePoint recycle bin?

Deleted files are typically retained in the SharePoint recycle bins for a total of 93 days. They stay in the first-stage (site) recycle bin until they are manually deleted or until the time expires, after which they are moved to the second-stage (site collection) recycle bin for the remainder of the 93 days.

Who is authorized to access the Microsoft Purview compliance portal?

Only users assigned specific administrative roles, such as Global Administrator, Compliance Administrator, or Audit Manager, can access the compliance portal to review retention policies and audit logs. Standard site owners do not have this level of access.

Migration & Recovery