How can I find out who deleted my Site Collection in SharePoint Online 2013?

Question

One of my colleagues accidentally deleted a site collection. We were able to recover the site collection but haven't been able to figure out where to find the audit logs to see who actually deleted it. We're fairly new in O365, hence the error. I've tried searching this forum and others but haven't found any luck. Any help would be greatly appreciated!

Answer 1

You can use the SharePoint Online Management Shell to get and restore site collections from the Recycle Bin in SharePoint Online

Get-SPODeletedSite - Returns all deleted site collections from the Recycle Bin

Restore-SPODeletedSite - Restores a SharePoint Online deleted site collection from the Recycle Bin

How to get deleted site collection

• Click Start>All Programs>SharePoint Online Management Shell.

• Run Connect-SPOService. For example,

  Connect-SPOService -Url https://contoso-admin.sharepoint.com -credential [email protected]

  where: Url is the URL of the SharePoint Online Administration Center. Credential is the user name to which you want to grant access to the SharePoint Online Administration Center site.

• Run Get-SPODeletedSite -Identity http://contoso.sharepoint.com/sites/marketing to return deleted site collection from the Recycle Bin

---

When the site collection is deleted, Cmdlet Get-SPODeletedSite returns object DeletedSiteProperties that contain information about deletion time, but not about user who deleted Site.

So, it does not seem possible to determine the user who deleted Site.

Answer 2

if you already enable the auditing on sites then you will get the information, by default this feature disabled.

First you need to enable auditing because it is disabled by default. Go to the site settings page of your site collection and select the site collection features link. On the site collection features page, activate the "Reporting" feature. Audting is now enabled but it is not collecting any data.

Navigate back to the site collection settings page and select the Site Collection Audit Settings link. You will see a list of events that you can select to be audited. Check the boxes for the events you want then click OK. SharePoint Online is now actively collecting audit data.

Now go back to the site collection settings page and select the Audit Log Reports link. There are a number of pre-canned reports that you can select from. Select one of the reports -if there is data that has been collected then you will be prompted by Excel to open the data in a spreadsheet.

The volume of data collected can be very large so I would recommend running a custom report where you can restrict the data returned by date range.

Here is the Offical link from the Microsoft.

Configure audit settings for a site collection