0

Several users (myself included) have gotten "Heads up!" emails from Sharepoint, saying that a large volume of files have been deleted. The files have been deleted, and it's typically a lot of files, in a 15-minute burst. But it's also happening at times when the user is not online and not logged in. (I can say with some certainty--it happened on my computer at 615a, before I had even turned my computer on for the day).

These 'ghost deletes' are extremely alarming--they are happening for folders and files outside of those typically accessed by users.

Office 365, Exchange license, 34 users (most part-time and semi-active), I'm the company administrator. Not finding anything on Google.

Mox
  • 101
  • 1
  • 1
    We don't get a whole lot of SharePoint traffic here. You might also want to try our sister site [sharepoint.se]. – Michael Hampton Jun 20 '21 at 22:59
  • Check your Azure AD sign-in logs and risky sign-in logs. – joeqwerty Jun 21 '21 at 00:28
  • Do the SharePoint sites have any workflows that might "clean up" files? Do users have any Flows or PowerApp automations? Check your SharePoint [audit] logs for details about which IP addresses the deletes are coming from. – SamErde Jun 28 '21 at 08:36

0 Answers0