Can you see who deleted a file in SharePoint?

Yes. The recycle bin shows a Deleted by column for every item, and site collection admins see every user's deletions. For items no longer in the bin, the Microsoft 365 audit log records FileDeleted events with the user and time.

How do I find out who deleted a folder in SharePoint Online?

Open the site recycle bin as a site collection admin, sort or filter by Deleted by. If the folder is no longer in the bin, search the Purview audit log for FileDeleted and FolderDeleted activities on that site.

How long does the SharePoint audit log keep delete events?

180 days by default for most licences (Audit Standard). Audit Premium extends retention to one year or longer with a retention policy.

How to see who deleted a file in SharePoint (and restore everything they deleted)

The recycle bin already records who deleted every item and when. Here is how to read it, how to check the audit log when the bin is empty, and how to restore one person's deletions as a set.

Two different questions hide in "who deleted it": who did it (so you can talk to them, or check whether it was a script) and what else did they delete (so you can fix all of it in one go). SharePoint answers both, in two different places.

If it is still in the recycle bin: the Deleted by column

The recycle bin stores, for every entry, the user who deleted it and the exact time. Site collection admins see every user's entries; everyone else sees only their own.

Settings gear → Site contents → Recycle bin. Add or sort by the Deleted by column. Sort by Deleted as well and the incident shows up as a tight block of one name and one time.

In PowerShell you get the same two fields, which is what makes bulk restore by person possible:

Connect-PnPOnline -Url https://contoso.sharepoint.com/sites/Finance -Interactive

Get-PnPRecycleBinItem -RowLimit 50000 |
  Group-Object DeletedByEmail |
  Sort-Object Count -Descending |
  Select-Object Count, Name

That one query turns "someone deleted a lot" into "p.jansen deleted 3,812 items and nobody else deleted more than 20". The follow-up, restoring everything that person deleted in that window, is in the bulk restore post.

A useful tell: if Deleted by is System Account or an app name, it was a retention policy, a flow, or a script, not a person.

If it is no longer in the bin: the audit log

Once an item has been purged, or if you need the history for something deleted months ago, the Microsoft 365 audit log is the record. It captures FileDeleted, FolderDeleted, FileRecycled (moved to the bin) and FileDeletedFirstStageRecycleBin / FileDeletedSecondStageRecycleBin (removed from a bin), each with user, time, site and path.

Purview portal → Audit → search with the activity set to Deleted file / Deleted folder, the date range, and the site URL. Or in PowerShell:

Connect-ExchangeOnline

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) `
  -RecordType SharePointFileOperation -Operations FileDeleted,FileRecycled `
  -ObjectIds 'https://contoso.sharepoint.com/sites/Finance/*' -ResultSize 5000 |
  Select-Object CreationDate, UserIds, Operations, ObjectId

Two limits to know: the audit log is not instant (expect up to 30 minutes of lag), and it keeps events for 180 days by default. Beyond that you need Audit Premium retention or a backup product's own logs.

Reading the pattern, not just the name

Once you have the list, look at the shape of it before restoring:

Hundreds of files, seconds apart, one user, one folder tree — a sync-client or File Explorer deletion. Restore the set; then check that user's sync setup.
Files spread across days, one user — deliberate housekeeping. Talk before restoring.
Deleted by System Account — a retention or flow action. Restoring it may just get it deleted again; find the policy first.
FileDeletedSecondStageRecycleBin events — someone emptied the bin. The 93-day safety net is gone for those items; check the Preservation Hold Library and the 14-day support window.

Doing it from the page

All of the above is possible with admin rights and two PowerShell modules. If the person answering "who deleted this?" is a site owner rather than an IT admin, a recycle-bin search that already shows Deleted by for every user and lets them filter and restore one person's deletions as a set is the practical answer. Undelete365 shows that view for free; restoring the set is the Pro part.