Find who deleted files in SharePoint using PowerShell (from the recycle bin)

Recently, I’ve seen a few requests about how can we get who deleted files in a SharePoint Online site? You know… that “Deleted by” column in the recycle bin?
 

But have you tried to get the value of that column with PnP PowerShell? Of course you have, by using the DeletedBy property of Get-PnPRecycleBinItem… And have you noticed something like, blank results? 😟

Well, I’ve stumbled on that too! Some CSOM objects are not returned (blank) and this is not an easy fix unfortunately, BUT changes might come in the future. So for now, we can use the following workaround!

User details

Connect to your site using Connect-PnPOnline and then we’ve got the usual suspects (for example) with $results = @() to store our results, and a foreach loop for all the items in the recycle bin. The important part in the script is how do we get the user name, or (like I’ve seen being asked) the user ID?? 🤔

Looking at the script below, I can get the name of the user with $item.DeletedByName:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

Connect-PnPOnline -Url "https://<TENANT-NAME>.sharepoint.com/sites/<YOUR-SITE>" -Credentials <your-creds>

$allDeletedItems = Get-PnPRecycleBinItem
$results = @()

foreach($item in $allDeletedItems){
    
    $results += [pscustomobject]@{
        fileName = $item.LeafName
        deletedBy = $item.DeletedByName
        deletedDate = $item.DeletedDate    
    }
}
$results