Need to know who deleted Column in sharepoint online list

Question

Hi Team,

Good day. I tried to find out the person who deleted the SharePoint online list column. I have used Microsoft Purview Portal but it's not returning any value. Any suggestion on this. I have selected 'Deleted List columns' in Activities and site url in site as shown below

Answer 1

@gokulnath palani

Thanks for using Microsoft Q&A forum and posting your query.

It seems like you're on the right track using the Microsoft Purview Portal.

Here are a few additional steps you can try to identify who deleted the column please confirm us if issue persists:

1. Audit Log Search: Ensure that you have the necessary permissions to access audit logs. Go to the Microsoft Purview Portal, navigate to Audit > Search. Make sure you have selected the correct date range and activities. You can try searching for "Deleted column" or "Modified column" activities.
2. Check Recycle Bin: Sometimes, deleted columns might appear in the Recycle Bin. Navigate to the Recycle Bin in your SharePoint site and see if the deleted column is listed there. This might give you some clues about who deleted it.
3. PowerShell Script: If the above methods don't work, you can use PowerShell to retrieve audit logs. Here's a sample script to get you started:

# Connect to SharePoint Online
Connect-SPOService -Url https://yourdomain-admin.sharepoint.com

# Get audit logs
$auditLogs = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -RecordType SharePoint -Operations "Deleted column"

# Filter logs for the specific site and column
$filteredLogs = $auditLogs | Where-Object { $_.SiteUrl -eq "https://yourdomain.sharepoint.com/sites/yoursite" -and $_.ItemName -eq "ColumnName" }

# Output the results
$filteredLogs | Format-Table

I hope the above steps will resolve the issue, please do let us know if issue persists. Thank you