Deleted Users

The Deleted Users section in MSPControl is used to review user accounts that were previously removed from an organization. This page helps administrators track deleted accounts, confirm who removed them, check when deletion happened, and open each deleted user record for additional investigation. It is a historical and administrative review area rather than a place for managing active users.

The section includes a main list page and a deleted user details view. From the main list, administrators can search and filter deleted records, adjust table visibility, and open user-related actions. After opening a deleted user, MSPControl provides separate tabs for General, Archives, and Audit Log, allowing a more detailed review of preserved information.

Table of Contents

• Deleted Users Overview
• Deleted Users List Page
• Deleted User General Tab
• Deleted User Archives Tab
• Deleted User Audit Log Tab
• Best Practices

Deleted Users Overview

The Deleted Users menu is located under the organization area and opens a list of accounts that are no longer active because they were deleted. This gives administrators a way to inspect historical user records without returning them to the active user list.

This section is especially useful when someone needs to confirm whether a user was removed, identify who performed the deletion, check the date and time of the action, or inspect what historical information still exists for that account. It can also be used during audits, support investigations, internal reviews, and cleanup validation tasks.

When you select a deleted user from the list, MSPControl opens a dedicated details page with separate tabs for reviewing general account information, archive records, and audit history.

Deleted Users List Page

The main Deleted Users page displays all deleted user records in a table. This is the starting point for reviewing removed accounts across the organization. The table is designed to help administrators quickly find a deleted user and inspect the most important information without opening every record individually.

Each row represents one deleted user and includes key fields related to identity, email, deletion history, and available actions.

Deleted Users Page Controls

1. Category Filter allows you to narrow the list based on the available filtering options in the dropdown. This is helpful when the environment contains many deleted users and the administrator wants to reduce the visible result set.
2. Search allows you to quickly locate a deleted user by typing part of the display name, login, or another searchable value shown in the table.
3. Column Visibility allows administrators to choose which columns remain visible in the table. This is useful when focusing only on the fields relevant to a particular review task.
4. Page Size Selector controls how many deleted user records are displayed on one page at a time.
5. Sorting Controls on column headers allow the table to be reordered based on the selected field, helping administrators find the newest, oldest, or most relevant records faster.

Deleted Users Table Columns

1. Display Name shows the visible full name of the deleted user.
2. Login shows the login name or primary sign-in identifier used by the user.
3. Primary E-mail Address shows the main email address that was associated with the account.
4. Deleted By identifies the administrator or account that performed the deletion.
5. Deleted On shows the date and time when the user was deleted.
6. OneDrive New Owner shows the user or target account that became the new owner of OneDrive-related content, when applicable.
7. Actions provides row-level controls for working with the deleted user record.

The list page is important because it gives administrators a fast summary of user deletion history before they open the full deleted user record.

Actions Column

The Actions column contains two buttons for each deleted user:

1. Go to Archives list opens the archive list related to that deleted user so the administrator can review preserved records or stored items associated with the removed account.
2. Delete user permanently removes the deleted user record from this historical list.

This means the Deleted Users section does not only store historical references. It also allows administrators to perform a final removal of the deleted user entry itself when that record no longer needs to remain visible in MSPControl.

Because this action affects historical visibility, it should be used carefully and only when the organization is certain that the deleted user record is no longer needed for review, auditing, or support purposes.

Deleted User General Tab

The General tab shows the main profile and service-related information that was associated with the user at the time the account was deleted. This page is informational and helps administrators understand what kind of account was removed, what settings were assigned, and which connected services or features were enabled or disabled.

At the top of the page, MSPControl displays the deleted user name, followed by tab navigation. The main content is grouped into expandable sections, which makes the page easier to review when the user record contains many fields.

Deleted User Section

The Deleted User section contains the core identity and service settings for the removed account. This is the first place to check when you need to validate what kind of user record existed before deletion.

1. Login Name shows the username or primary sign-in identifier assigned to the deleted user.
2. Display Name shows the full visible name of the user as it appeared in MSPControl.
3. Notes can store additional administrative comments associated with the user account.
4. Deleted On shows the date when the user was removed.
5. Deleted By identifies the administrative account or role responsible for the deletion action.
6. Is Azure User indicates whether the deleted account was associated with Azure-based identity or management.
7. Kind Of Licenses shows whether license-related information existed for the user.
8. Location reflects whether a location value was stored for the user.
9. Email Aliases indicates whether the user had additional email aliases configured.
10. Enable Email Security shows whether email security services were enabled for the account.
11. Enable Email Protection Report shows whether email protection reporting was active for the user.
12. Email Signature indicates whether a signature configuration existed.
13. Groups And Distribution Lists shows whether the user had associated group or distribution list membership details.
14. Access To RDS shows whether the user had Remote Desktop Services access enabled.
15. Access To Cloud Folder indicates whether the user had access to a cloud folder or mapped cloud storage resource.
16. Have Personal Folder With Information shows whether the user had an individual folder or personal data area tracked by the platform.

This section is useful when administrators need to reconstruct the deleted user’s former service profile during audits, support reviews, or internal validation tasks.

Service Levels Section

The Service Levels section shows whether the deleted user was assigned any service-tier designation. In the example shown, the page includes a VIP checkbox.

This type of field is useful when service priority, entitlement level, or support classification needs to be verified after deletion. Even if a deleted account is no longer active, knowing whether it had a premium or special support status can help explain historical handling, service scope, or exceptions applied to that user.

Advanced Section

The Advanced section exposes technical or directory-related values that were linked to the user. In the example shown, the page includes a User Domain Name value.

This field is important for environments that use domain-based identity, local directory integration, hybrid deployments, or remote access structures. It helps administrators verify the exact domain-formatted user identity that existed before deletion, which can be especially useful during troubleshooting, directory cleanup, or cross-system comparison.

Deleted User Archives Tab

The Archives tab provides access to historical archived items associated with the deleted user. This area is intended for reviewing files or preserved records that remain available even after the user account itself has been removed.

The page includes filtering, searching, column display controls, and a record counter, which allows administrators to handle large archive sets more efficiently when archived content exists.

Archives Page Controls

1. Category Filter allows you to narrow the displayed results based on archive type or grouping. This helps reduce noise when a user has many archived items.
2. Search allows you to search archive records by available indexed values, such as file-related details or other listed metadata.
3. Column Visibility lets administrators control which columns are shown in the grid. This is useful when focusing on only the most relevant fields during review.
4. Page Size Selector controls how many records are displayed in the table at once.
5. Sorting Controls on columns such as Name, Date, and Size help administrators reorganize the table to find the most relevant entries faster.
6. Exit returns the administrator out of the current deleted user archives view.

When no archived records exist, the table remains empty and displays a no-records message. This does not indicate an error. It simply means MSPControl has no archived items available for that deleted user in the current context.

This tab is most useful when administrators need to check whether any retained information exists for a removed user before concluding an investigation, responding to an internal request, or confirming whether historical data cleanup was complete.

Deleted User Audit Log Tab

The Audit Log tab is used to review recorded actions related to the deleted user. This area helps determine whether MSPControl logged events involving the account and provides another historical layer for tracking user-related activity.

The audit grid is structured for review rather than editing. It is intended to help administrators inspect actions after the fact, especially in cases involving security review, operational traceability, or internal accountability.

Audit Log Page Controls

1. Column Visibility lets administrators choose which audit columns remain visible while reviewing the log.
2. Page Size Selector controls the number of log entries shown in the table.
3. User identifies the account or actor associated with the recorded event.
4. Scheduler indicates whether the action was linked to an automated process, scheduled operation, or background task.
5. Message shows the audit description or recorded event detail.
6. Action Date shows when the activity took place.

If no records are displayed, that means there are no audit entries available for the deleted user in the current view. This can happen when no relevant actions were logged, when the user had limited platform activity, or when the specific area being reviewed did not generate audit events.

This tab should be checked whenever an administrator needs to validate whether any recorded actions exist around the deleted account, particularly when investigating account lifecycle events or reviewing administrative changes.

Best Practices

• Use the main Deleted Users list to identify the correct record first by comparing display name, login, primary email address, and deletion date.
• Review the Deleted By and Deleted On columns early during investigations, since these values establish the most important accountability details.
• Use Go to Archives list when you need to inspect retained information connected to a removed account before making any further decision.
• Use the General tab first when opening a deleted user, because it provides the fastest summary of what services and settings were associated with that account.
• Check the Audit Log tab whenever you need to validate whether there is a traceable activity history connected to the deleted account.
• Do not assume that an empty Archives or Audit Log page is a problem. In many cases, it simply means no records were available for that user in that specific area.
• Use the Delete user action carefully, because it removes the deleted user record itself from the historical list and may reduce future administrative visibility.
• When comparing deleted and active users, rely on domain values, login names, display names, and primary email addresses together rather than depending on only one field.