Sharepoint files got deleted by "System Account"

A Microsoft 365 administrator should search the Purview audit log for the affected files and timestamp, because “System Account” alone does not identify which user, application, synchronization client, or policy initiated the deletion.

1. Identify the initiating action

The administrator needs the Audit Logs or View-Only Audit Logs role. If those permissions are unavailable, send the affected site URL, filenames, and approximate deletion time to the Microsoft 365 administrator. ^1^

1. Open the Microsoft Purview portal.
2. Select Solutions → Audit → Search.
3. Set:
   • Date and time range (UTC): Cover the incident, including time before and after it.
   • Workload/record type: Microsoft SharePoint or the applicable SharePoint record type.
   • Keyword: A distinctive filename, folder name, or site path.
   • Operations: Search for these exact values:
     • FileRecycled
     • FileDeleted
     • FileDeletedFirstStageRecycleBin
     • FileDeletedSecondStageRecycleBin
     • FolderRecycled
     • FolderDeleted
     • FolderDeletedFirstStageRecycleBin
     • FolderDeletedSecondStageRecycleBin
4. Run the search and export the results.
5. Examine the event details for:
   • User or application identity
   • File/folder URL
   • Operation
   • Timestamp
   • Client IP and user agent, when populated
   • UserObjectId, DeviceId, AADSessionId, or UniqueTokenId

These operations distinguish moving an item into the Recycle Bin from deleting it from either Recycle Bin stage. ^2^

If linkable identifiers are present, correlate the session or token with Microsoft Entra sign-in logs. SharePoint audit records can expose UserObjectId, DeviceId, AADSessionId, and UniqueTokenId for this purpose. ^3^

Audit events commonly take 60–90 minutes to appear, although Microsoft does not guarantee a specific ingestion time. Audit Standard normally retains records for 180 days; applicable E5 licensing retains SharePoint activity for one year by default. ^1^

2. Apply the prevention control matching the audit result

If the deletion came through OneDrive synchronization

Deleting a file or folder from a locally synchronized SharePoint library is synchronized back to SharePoint as a deletion. A local application—such as antivirus software quarantining a file—can cause the same outcome. ^4^

On the device identified by the audit record:

1. Select the OneDrive cloud icon in the Windows system tray.
2. Open the OneDrive settings and select Stop sync for the affected SharePoint library.
3. Investigate the local Windows Recycle Bin, antivirus/quarantine history, backup software, cleanup scripts, and recent folder moves.
4. Resume synchronization only after the process responsible for the deletion has been corrected.

Do not stop synchronization for every user unless the evidence shows multiple affected devices.

If the files are Teams meeting recordings

Teams recording expiration can initiate deletion while SharePoint acts as the storage backend, causing the deletion to appear as a SharePoint application action.

In the applicable Teams meeting policy, either:

• Extend the meeting-recording expiration period, or
• Disable recording expiration.

A Purview retention policy can additionally preserve the recording when Teams initiates deletion. ^5^

If the operation is a Priority Cleanup event

Look specifically for:

• PriorityCleanupFileRecycled
• PriorityCleanupFileDeleted

These mean a Microsoft Purview Priority Cleanup policy moved the item to the second-stage Recycle Bin or permanently deleted it. Review Purview → Solutions → Data Lifecycle Management → Priority cleanup, then identify the policy using its cleanup ID. ^6^

Pause or correct that policy only after confirming its compliance purpose and scope.

3. Protect important libraries from future permanent loss

For business-critical content, configure an appropriate Microsoft Purview retention policy or retention label. When retained content is changed or deleted, SharePoint can preserve a copy in the hidden Preservation Hold library; some record-label configurations block deletion entirely. Retention should be designed with the compliance owner because it also affects storage, disposal, and legal obligations. ^7^

Since the files have already been restored, preserve the audit export and incident timestamps before changing synchronization or retention settings. If the audit record still cannot identify the initiating user, application, or policy, open a Microsoft 365 support request and include the site URL, affected filenames, UTC timestamps, and exported audit results.

References

1. Search the audit log
2. Audit log activities
3. Track and investigate identity activities with linkable identifiers in Microsoft Entra
4. A file that was synchronized in SharePoint Online or OneDrive is moved to the recycle bin
5. Query on deletion - Microsoft Q&A
6. Permanently delete files with Microsoft Purview Priority Cleanup
7. Learn about retention for SharePoint and OneDrive