Audit And Compliance – Who Deleted That File?

Home / Office 365 audit / Audit And Compliance – Who Deleted That File?

Audit And Compliance – Who Deleted That File?

The audit data which Microsoft provides is pretty powerful, but there is a lot of data gathered from even very small tenants. Making sense of this information is something that we can help you do in our Audit and Compliance module.

In our first blog post I described the user interface that we’ve built to allow you to get a better understanding of the audit data that is available.  In another blog post we described how to research information about a particular user and password resets which had been affecting the users’ ability to login.

This blog post looks at some different data. Our helpdesk might get contacted by a user who says that they have been using a particular file on SharePoint for a while, and suddenly it’s ‘gone’.

The starting point is with querying the audit data. Let’s see how that can be done in our Audit and Compliance module.

The person calling the helpdesk tells us the name of the file: allison_5697.

This means that straight away we can do a full text search for this file, over a date range. We can see the results of that here:

Our ‘Audited events chart’ now shows the results of this exact query, and below that we can see a timeline of those events too.

Notice that we didn’t pick a particular ‘Workload’ even though we could have done.  If many files had been returned with the same name, or we had activities from OneDrive as well as SharePoint then would have made our query more specific.

For this particular simplified example our timeline looks like this:

The most recent event for the file allison_5697, and very probably the reason that the person contacting the helpdesk can’t find it, is that the file was deleted. As we can see, the person who deleted the file was RWilcox. By clicking on the arrow below the event more detail can be seen.

Who deleted the file

We can provide the the answer to who deleted the file, and when, to the person who contacted the Helpdesk, either via a screenshot like this, or by creating a PDF output.

The above example is just one of the ways that you query the audit data to make daily management of Office 365 more efficient.. Why not sign up for a trial of our Audit & Compliance module and start troubleshooting your Office 365 tenant today.

Related Posts