On our SPO Tenant we had had some Users who have accidentally deleted over 20k documents. This has been occurring over the past few months which has meant that the team in question didn't want to restore ALL files, instead they wanted to sift through specific ones (against my recommendation).

using get-pnprecyclebinitem | out-file *****.csv I have been getting the file information, but it would be useful to get the person who deleted the file's name - or any other information.

I can see there are commands with On Prem environments that allow this, but I haven't seen anything for SharePoint Online.


I would suggest using the Office 365 Security and Compliance Center in the Office 365 Admin portal. From there you can perform an audit search by file activity (Delete) by file name and/or URL.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.