Mass File Deletion Alerts: OneDrive & SharePoint Detection Layers
Four detection layers for mass file deletion in OneDrive and SharePoint: E3 Alert Policies, E5 Insider Risk Management, DLP, and Intune Conditional Access automation. Covers required licensing, configuration steps, and an incident response playbook.
When a User Deletes 500 Files,
You Should Know in Minutes.
Mass deletion from OneDrive or SharePoint is one of the clearest signals of insider threat, ransomware staging, or a departing employee covering their tracks. Microsoft 365 gives you four independent detection layers — from a simple E3 audit alert to Insider Risk policies that correlate behaviour over time. This guide covers all four, the licensing each requires, and how to wire them to Intune Conditional Access so a compromised device can be blocked automatically.
⚡ The Threat Scenario
Three distinct scenarios produce the same signal — a user mass-deleting files from OneDrive or SharePoint. Each demands a different response, but all three need to be detected fast.
🏃 Departing Employee
Employee gives notice (or is terminated) and begins deleting personal or project files before their last day. Often deletes selectively to remove evidence of IP theft or remove work product. Most common scenario — and the easiest to miss without alerts.
🦠 Ransomware Staging
Ransomware operator deletes volume shadow copies and backup files before encrypting, or encrypts files in place causing SharePoint to register thousands of FileModified/FileDeleted events in minutes. Mass deletion at machine speed from a single account is the pattern.
😤 Disgruntled Insider
Malicious insider deliberately destroys shared team data — project libraries, customer records, shared drives. May be triggered by a workplace dispute. Often happens outside business hours on a weekend when nobody is watching dashboards.
The common requirement: detection in minutes, not hours. By the time a daily audit report surfaces the deletion, the recycle bin retention window may have passed on some files. Speed of detection directly determines recoverability.
🪪 Licensing Requirements
You do not need E5 to get meaningful detection. The four layers map cleanly to three licensing tiers.
Audit Log Alert Policies
FileDeleted / FileRecycled audit eventsInsider Risk Management
Full Stack + Intune Integration
| Capability | E3 | E5 Compliance | E5 / E5 Security |
|---|---|---|---|
| Audit log alert on deletion count | ✅ Included | ✅ | ✅ |
| Insider Risk Management policies | ❌ | ✅ Included | ✅ |
| DLP on SharePoint/OneDrive | ❌ | ✅ Included | ✅ |
| Defender for Cloud Apps session policy | ❌ | ❌ | ✅ Included |
| Intune Conditional Access block | Intune Plan 1 | Intune Plan 1 | ✅ Included |
| Microsoft Sentinel hunting | ❌ | ❌ | Sentinel add-on |
📋 Layer 1 — Audit Log Alert Policies (E3+)
This is the fastest path to detection. Microsoft 365 Compliance Center supports Alert Policies that fire on Unified Audit Log events — including FileDeleted and FileRecycled from SharePoint and OneDrive. No additional licensing beyond E3 required.
Open Alert Policies in Microsoft Purview
Navigate to compliance.microsoft.com → Policies → Alert policies → New alert policy.
Configure the deletion alert
Set the following values — these are calibrated for signal quality without excessive noise on a typical tenant:
| Field | Value |
|---|---|
| Name | Mass File Deletion — OneDrive/SharePoint |
| Severity | High |
| Category | Threat management |
| Activity | Deleted file (covers both FileDeleted + FileRecycled) |
| How to trigger | Activity matches a rule — count exceeds threshold |
| Threshold | 50 activities in 10 minutes |
| Per user | Enabled — alert fires per individual user, not aggregate |
| Recipients | Security team DL + IT admin |
💡 Threshold of 50/10 min catches ransomware-speed deletion while avoiding alerts on a user who cleans up a project folder. Adjust to your environment — start higher if noise is a problem, lower if you need tighter detection.
Add a second alert for bulk SharePoint library deletion
Create a separate policy with activity type Deleted list items in bulk — this catches operations like "Delete All" on a document library that the file-level event might not aggregate correctly. Threshold: 1 activity (any bulk delete triggers immediately).
💡 This second alert requires no additional licensing and catches the scenario where a site owner deletes an entire library, which in SharePoint is a single admin action rather than N individual FileDeleted events.
🔍 Layer 2 — Insider Risk Management (E5 Compliance)
Audit alerts tell you something happened. Insider Risk Management tells you who it likely is and why it matters. IRM correlates the deletion event with HR signals (resignation, PIP status), prior download volume, email behaviour, and device activity — producing a risk score rather than a raw count.
Prerequisites
- M365 E5 Compliance (or E5 Security, or standalone Insider Risk Management add-on)
- Enable Audit log — compliance.microsoft.com → Audit → Start recording
- Configure HR connector if you want resignation/termination signals from your HRIS
- Assign Insider Risk Management role to your security team in Microsoft Purview
Create a "Data leaks" policy
Navigate to Microsoft Purview → Insider risk management → Policies → Create policy. Choose template: Data leaks. This template detects sequences: high-volume download → deletion → upload to personal cloud, or deletion after receiving a resignation confirmation.
Configure triggering events
For mass deletion specifically, set:
- Triggering event: User performs a high-volume file deletion activity
- Threshold indicator: SharePoint file deletions — set to Customized thresholds, configure 100 deletions in 24h as medium, 300 in 24h as high
- Sequence detection: Enable — looks for deletion + download combination in same window
Add "Data theft by departing users" policy
If you have an HR connector configured, this second policy fires automatically when a user with an active resignation date in your HRIS starts deleting files above threshold. The resignation signal dramatically increases the risk score — a deletion that would score "medium" for a random employee scores "high" for someone leaving in two weeks.
💡 HR connector setup: Microsoft Purview → Data connectors → HR. Supports BambooHR, Workday, SAP SuccessFactors natively. CSV import also available for smaller orgs without a supported HRIS.
| User | Policy | Risk score | Status | Date |
|---|---|---|---|---|
| j.smith@contoso.com | Data theft by departing users | High — 87 | Needs review | Today, 14:32 |
| a.johnson@contoso.com | General data leaks | Medium — 52 | In triage | Today, 09:15 |
🚧 Layer 3 — DLP Policy on Bulk Operations (E5 Compliance)
Data Loss Prevention policies on SharePoint and OneDrive can be configured to detect and respond to mass file operations — not just exfiltration. A DLP policy can alert, block, or require justification when a user attempts to delete above a volume threshold.
⚠️ DLP vs Alert Policy — Know the Difference
Alert policies (Layer 1) are reactive — they notify after the events are logged. DLP can be preventive — it can intercept the operation before it completes and require the user to provide a justification or notify their manager. For ransomware scenarios, this difference matters. For insider threat, the audit trail of an attempted deletion + forced justification is sometimes more valuable than a block.
Create a DLP policy scoped to SharePoint and OneDrive
Microsoft Purview → Data loss prevention → Policies → Create policy. Choose Custom policy. Scope: SharePoint sites and OneDrive accounts.
Configure the rule condition
Under Rules → Add rule:
- Condition: Content is shared → Content contains → Activity type: User deletes content
- Volume: More than 100 items in a single session
- Action: Restrict access or encrypt the content → Block everyone except the content owner
- User notification: Enabled — show policy tip requiring business justification
- Incident report: Send to security DL, severity High
Run in audit mode first
Set the policy to Test mode with policy tips for 2 weeks before enforcing. This surfaces false positives — backup jobs, migration scripts, archive tools — so you can scope them out before the policy blocks legitimate operations.
💡 Common false positives: SharePoint migration tools (Sharegate, SPMT), backup agents, Power Automate flows that process and delete staging files. Add service accounts for these tools to the DLP exclusion list before go-live.
📱 Layer 4 — Intune + Conditional Access Integration
Layers 1–3 detect and alert. Layer 4 responds automatically. The integration between Intune device compliance and Entra Conditional Access means you can block a device from accessing SharePoint and OneDrive the moment a mass deletion alert fires — without waiting for a human to act.
How the Chain Works
Step 1 — Create a Conditional Access Policy for Non-Compliant Devices
Create the CA policy in Entra ID
entra.microsoft.com → Protection → Conditional Access → New policy
- Name:
Block Non-Compliant — SharePoint/OneDrive - Users: All users (or scope to your target groups)
- Target resources: Office 365 SharePoint Online
- Conditions: Device platforms → All platforms
- Grant: Require device to be marked as compliant
- Session: Sign-in frequency → Every time (revoke sessions immediately on compliance change)
- Enable policy: On
Step 2 — Automate the Non-Compliant Mark via Power Automate
Build the alert → Intune automation flow
When the Purview alert fires, it can trigger a Power Automate flow via the Office 365 Management Activity API webhook. The flow calls the Microsoft Graph API to mark the device as non-compliant:
PATCH https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{deviceId}
{
"complianceState": "noncompliant"
}The device ID is resolved by querying Intune with the user's UPN from the alert. Once marked non-compliant, Conditional Access picks it up at the next token evaluation — typically within 1–5 minutes.
💡 Requires DeviceManagementManagedDevices.ReadWrite.All permission on the service principal running the flow. Use a dedicated app registration, not a user account.
Step 3 — Configure Automatic Remediation Path
Define the remediation workflow for Security team
Once the device is blocked, define a clear path to restore access:
- Security team reviews the Purview alert and IRM case
- If activity is determined legitimate (migration, backup cleanup) → re-mark device compliant via Intune console and document justification
- If activity is suspicious → escalate to incident response, preserve evidence, disable user account pending investigation
- Target: review and decision within 2 hours of alert fire
🏗️ Full Detection Architecture
All four layers working together give you coverage across licensing tiers, detection speed, and response automation.
| Layer | What Detects | Speed | Response | Licensing |
|---|---|---|---|---|
| 1 — Audit Alert | Raw count — 50+ deletions in 10 min, any user | ~5 min | Email + Teams alert to security team | E3 |
| 2 — Insider Risk | Behavioural pattern — deletion + download + HR signal | 15–60 min | Risk case in IRM queue, risk score, analyst review | E5 Compliance |
| 3 — DLP Policy | Bulk delete operation above volume in session | Real-time | Policy tip requiring justification, optional block | E5 Compliance |
| 4 — Intune + CA | Alert correlation → automatic device block | 1–5 min | Device marked non-compliant → CA blocks SharePoint/OD | E5 / Intune P1 |
📟 Alert Response Playbook
When the mass deletion alert fires, the first 30 minutes determine whether you can recover the data and contain the incident.
⏱️ Minutes 0–5 — Triage
- Open the Purview alert → note user, timestamp, count, and affected site/drive
- Check if user has an active IRM risk case — if yes, escalate immediately
- Check HR system: is this user on a PIP, has a resignation date, or was terminated today?
- Check Intune: what device? Managed or unmanaged? Last check-in?
⏱️ Minutes 5–15 — Contain
- If suspicious: mark device non-compliant in Intune (or trigger automated flow) → CA blocks access
- In SharePoint Admin: Active sites → [Site] → Site collection recycle bin — verify deleted files are still in bin (93-day retention by default)
- Check OneDrive recycle bin for the user: SharePoint Admin → Active users → [User] → Recycle bin
- Do NOT restore yet — preserve the deletion pattern as evidence
⏱️ Minutes 15–30 — Investigate or Clear
- Clear: Activity maps to a known migration job, backup task, or user cleanup of personal files → document, restore compliance, close alert
- Escalate: Deletion pattern correlates with departing user, sensitive content, or post-hours timing → open IRM case, notify CISO, preserve evidence before restoring
- If restoring data: use SharePoint Restore this library feature to roll back the entire library to a point-in-time before the deletion event
- Document decision, evidence links, and outcome in the IRM case or your ticketing system
SharePoint Point-in-Time Restore
# PowerShell — restore a SharePoint document library to a point in time
Connect-SPOService -Url https://contoso-admin.sharepoint.com
Restore-SPODeletedSite -Identity "https://contoso.sharepoint.com/sites/ProjectAlpha"
# For OneDrive — restore to specific date via admin:
# SharePoint Admin Center → Active users → [UPN] → OneDrive → Restore OneDrive
# Choose: date and time (up to 30 days for OneDrive, 93 days for SharePoint recycle bin)✅ Admin Setup Checklist
Layer 1 — Audit Alerts (E3, do first)- Enable Unified Audit Log — compliance.microsoft.com → Audit → Start recording
- Create Alert Policy: "Deleted file" — 50 events / 10 min / per user / High severity
- Create second Alert Policy: "Deleted list items in bulk" — 1 event / immediate
- Set recipients: security DL + on-call IT admin
- Test by deleting 55 files from a test OneDrive account — verify alert fires within 10 min
- Assign Insider Risk Management role to security team
- Create IRM policy: "General data leaks" — enable file deletion indicators
- Create IRM policy: "Data theft by departing users" (requires HR connector or manual user list)
- Set deletion thresholds: 100/day = medium, 300/day = high
- Configure HR data connector if HRIS is available
- Verify IRM alerts fire in test scenario (use test user with elevated deletion activity)
- Create DLP policy: bulk deletion on SharePoint/OneDrive — test mode first
- Identify and add service account exclusions (backup agents, migration tools)
- Review test mode results for 2 weeks — tune thresholds
- Switch policy to enforcement mode after tuning complete
- Create CA policy: Require compliant device for SharePoint Online access
- Create app registration for Graph API device compliance write
- Build Power Automate flow: Purview alert → Graph API → mark device non-compliant
- Test full chain: trigger alert → verify device marked → verify CA blocks SharePoint
- Document restore-compliance procedure for security team on-call
- Set SLA: 2-hour maximum for alert review and decision