SharePoint and OneDrive: How to Set Up Mass Delete Notifications in Microsoft 365

A user deletes hundreds of files from a SharePoint document library. Another accidentally removes an entire OneDrive folder while cleaning up old documents. In both cases, the damage may go unnoticed until someone needs a file that no longer exists.

For Microsoft 365 administrators, this is more than a file management problem. Unexpected bulk deletions can disrupt business operations, trigger compliance concerns, and create unnecessary recovery work.

SharePoint and OneDrive mass delete notifications help administrators identify potentially destructive activity before it turns into a larger incident. With the right combination of Microsoft Purview auditing, alert policies, Power Automate workflows, and appropriate recovery procedures, IT teams can improve visibility into deletion events and respond faster.

The important detail is that Microsoft 365 does not treat every bulk deletion as the same event. The best monitoring approach depends on the deletion method, the activity being recorded, the licensing available in your tenant, and how quickly your organization needs to react.

Why Mass Delete Monitoring Matters in Microsoft 365

SharePoint Online and OneDrive for Business are closely integrated, but they serve different collaboration needs. SharePoint supports team sites, shared document libraries, and organizational content. OneDrive provides personal work storage for individual users, including files shared with colleagues.

Both platforms allow users and applications to delete multiple files. That flexibility is useful, but it also introduces risk.

Common scenarios include:

• Accidental deletion: A user selects an entire folder instead of a single document.
• Synchronization problems: A deletion performed on a synchronized device propagates to cloud storage.
• Compromised accounts: An attacker deletes business documents to disrupt operations or interfere with recovery.
• Application errors: A script, integration, or migration process removes more content than intended.
• Insider activity: A user deliberately deletes organizational information before leaving the company.

A mass deletion notification provides an early warning that activity may require investigation. It does not automatically prove malicious behavior, nor does it guarantee that deleted content can be recovered.

The goal is to detect unusual activity, establish context, and give administrators enough time to take appropriate action.

How Microsoft 365 Detects Bulk Deletion Activity

There is no single universal switch that guarantees a notification whenever any user deletes a large number of files across SharePoint and OneDrive. Administrators generally combine auditing with an alerting mechanism.

1. Microsoft Purview Audit

Microsoft Purview Audit records supported user and administrative activities across Microsoft 365 services. Depending on the operation, relevant SharePoint and OneDrive audit activities include file and folder deletion events, such as FileDeleted and FolderDeleted.

Administrators can search audit records to investigate:

• Who performed the deletion.
• When the activity occurred.
• Which SharePoint site or OneDrive location was involved.
• Which files or folders were affected, where the available record contains that information.
• Whether multiple deletion events occurred within a short period.

Audit records are valuable for investigations and for validating whether an alerting rule works as expected.

However, audit logging and real-time notification are different capabilities. Recording a deletion does not automatically mean an administrator will receive an email or Teams message.

Audit availability, retention, searchable fields, and event coverage depend on the Microsoft 365 configuration, licensing, and the specific operation being investigated.

2. Microsoft Purview Alert Policies

Microsoft Purview provides alerting capabilities for supported activities and detection scenarios. Where an appropriate alert policy is available, administrators can configure it to notify designated recipients when matching activity is detected.

The exact configuration depends on the alert type and the controls exposed in the tenant. Do not assume that every Purview alert policy supports a configurable threshold such as 100 deleted files in 10 minutes.

For a true volume-based rule, verify that the selected alerting mechanism supports the required count, time window, and scope. If it does not, use an automation or monitoring solution that can evaluate those conditions explicitly.

This distinction matters because a useful mass deletion alert should measure a pattern of activity, not simply report every individual file deletion.

How to Configure a Practical Mass Delete Notification

For organizations that need a custom threshold, a common approach is to use audit data as the detection source and Power Automate or an Azure-based monitoring workflow as the notification layer.

The implementation should be designed around the audit interface and permissions available in your tenant.

Step 1: Define What Counts as a Mass Deletion

Start by establishing a measurable threshold.

For example, an organization might investigate when a single user deletes 100 or more files from a monitored site within 10 minutes. This is an illustrative starting point, not a Microsoft-recommended universal threshold.

Define the following parameters:

• Event types: File deletion, folder deletion, or both.
• Scope: Selected SharePoint sites, OneDrive accounts, or the entire tenant.
• Threshold: The number of qualifying events.
• Time window: The period in which those events must occur.
• Exclusions: Approved migration accounts, retention cleanup processes, or scheduled administrative jobs, where appropriate.
• Recipients: The security operations team, Microsoft 365 administrators, or designated site owners.

A threshold that is too low can create alert fatigue. A threshold that is too high can allow significant data loss to go unnoticed.

Step 2: Verify Audit Coverage

Open the Microsoft Purview portal and navigate to the Audit experience.

Run a search for a known deletion event from a test account, using a suitable date range and the available SharePoint or OneDrive activity filters. Review the returned records to confirm that the relevant operation appears and that the information needed for your detection logic is available.

Check that the account performing the search has the necessary audit permissions and that the tenant’s licensing and audit configuration support the investigation.

Before deploying a production rule, test both file deletion and folder deletion. A single folder deletion can remove access to a large amount of content without producing the same event pattern as deleting files individually.

Step 3: Build the Detection Workflow

If your tenant’s native alert policies cannot evaluate the required event count and time window, implement a workflow that can.

A typical design looks like this:

1. Retrieve supported audit events through an authorized audit search or reporting interface.
2. Filter for the relevant SharePoint and OneDrive deletion operations.
3. Group qualifying events by user, site or drive, and time window.
4. Compare the event count against the configured threshold.
5. Create an alert when the threshold is exceeded.
6. Record the detection result so repeated checks do not generate unnecessary duplicate notifications.

Power Automate may be suitable for orchestrating notifications and straightforward workflows, provided the required data source and connectors are available. More demanding implementations may use Azure Functions, Logic Apps, Microsoft Sentinel, or another monitoring platform.

Avoid assuming that a standard Power Automate trigger automatically receives every SharePoint or OneDrive deletion across the tenant. A workflow needs a supported way to collect the relevant events and enough information to calculate the threshold.

Step 4: Send an Actionable Notification

A useful alert should give responders enough information to begin investigating without exposing unnecessary document contents.

Include:

• User or service account associated with the activity.
• Detection time and monitoring window.
• Number of matching deletion events.
• Affected site or OneDrive location.
• A link to the relevant audit investigation, where supported.
• The rule that triggered the notification.
• Recommended response steps.

Send notifications through an approved channel, such as email, Microsoft Teams, or an incident management platform.

Where possible, use a single aggregated alert for a burst of deletion activity rather than sending a separate message for every deleted file.

Step 5: Test and Tune the Rule

Validate the implementation with controlled scenarios before relying on it in production.

Test a small deletion, a deletion that exceeds the threshold, a folder deletion, and a legitimate bulk cleanup operation. Confirm that the expected events are collected, the threshold is calculated correctly, and the notification reaches the intended recipients.

Also verify detection latency. Audit ingestion and search availability may introduce delays, so an audit-driven workflow should not automatically be described as instantaneous or real-time.

What to Do When a Mass Deletion Alert Fires

A notification is the start of an investigation, not the end of one.

Administrators should first establish whether the activity was authorized. Check the user’s recent actions, the affected location, any associated automation, and whether the deletion matches an approved business process.

If the activity appears suspicious, follow your incident response procedures. Depending on the circumstances, that may include restricting account access, revoking active sessions, reviewing authentication logs, and preserving relevant audit evidence.

For recovery, check the appropriate SharePoint or OneDrive recycle bin and available retention or recovery options. SharePoint administrators may also be able to use supported site recovery capabilities, depending on the circumstances and timing.

Do not assume that every deleted item can be restored indefinitely. Recovery options depend on the service, deletion method, retention configuration, and applicable time limits.

Organizations with regulatory requirements should also review whether their retention policies and preservation controls meet their obligations. A deletion alert is not a substitute for a properly designed retention strategy.

Common Mistakes to Avoid

Relying on audit logs alone. Audit records provide evidence, but a separate detection and notification mechanism may be necessary.

Monitoring file deletions but ignoring folders. Folder-level operations can affect substantial amounts of content and require separate testing.

Treating every bulk deletion as an attack. Migration projects, cleanup jobs, and legitimate user actions can produce similar patterns. Alert context and sensible exclusions are essential.

Ignoring licensing and permissions. Audit access, retention, alert features, and integration options can vary across Microsoft 365 plans and tenant configurations.

Promising real-time detection without testing latency. Confirm the actual collection and processing intervals before defining response-time expectations.

A More Reliable Approach to SharePoint and OneDrive Protection

Mass deletion monitoring works best as part of a broader Microsoft 365 security strategy. Combine audit visibility with volume-based detection, actionable notifications, tested recovery procedures, and clear incident response ownership.

For most organizations, the next step is to pilot a threshold-based rule on a small set of critical SharePoint sites and OneDrive accounts. Validate the event coverage, measure detection delays, and tune the threshold before expanding the deployment.

The result is a monitoring process that does more than record deleted files. It helps your IT team recognize unusual activity, investigate it with the right context, and respond before a manageable mistake becomes a serious business disruption.

Extra posts:

How to Remove Expiration from Microsoft Teams Recordings (OneDrive/SharePoint and Stream) Microsoft Planner Will Delete Unused Meeting Plans After 180 Days Here’s What Users Need to Know How to Create an Approval Workflow in SharePoint Online (Microsoft 365) Microsoft Teams Is Getting a Smarter Way to Manage Channel Notifications Unlocking Searchable Content OCR for OneDrive for Business Now Available in Microsoft 365 Admin Center Microsoft OneDrive and SharePoint Are Getting AI-Powered PDF Navigation