How to Recover Deleted Emails from Microsoft 365 Mailbox

Users delete the emails either by accident or on purpose. When crucial business or personal information is lost as a result, it can lead to concern if the deletion was unintentional. Fortunately, in Exchange Online, administrators have the ability to audit email deletions and recover permanently deleted emails from a user’s mailbox. This includes emails that have been permanently deleted (purged) by a user or removed by an automated retention policy. However, these messages can only be retrieved if the deleted item retention period has not expired.

When a user deletes an email (or any mailbox item like a contact, calendar event, or task), the following stages of deletion can occur.

1. Deleted Items Folder

• When you delete an email from your mailbox (for example, by pressing the delete key), it moves to the Deleted Items folder. It stays there until you either delete it manually or it’s automatically removed by retention policies.

2. Soft Delete

• When a user uses Shift + Delete to delete an email from any folder, or delete an email from the Deleted Items folder, it is moved to the Recoverable Items subfolder. In the Outlook UI, it is displayed under the ‘Recover items deleted from this folder’ option, inside the Deleted Items folder itself. This process is referred to as a soft delete.

3. Hard Delete

• Emails in the Recover Deleted Items folder are kept for 14 days by default (but administrators can increase the retention limit up to 30 days). After this retention period, they are moved to the Purges subfolder and become invisible to users.

• As Exchange Online automatically turns on single item recovery for new mailboxes, admins have the ability to restore hard-deleted items. However, users cannot recover hard-deleted emails themselves.

Ensure the following settings are in place to successfully recover deleted or purged emails.

1. Single Item Recovery

This feature ensures that even permanently deleted items are retained for a specified period. Emails deleted when Single Item Recovery is disabled cannot be recovered—this is a critical point to keep in mind. Therefore, it is essential to enable single item recovery on mailboxes for effective recovery.

2. Mailbox Import Export Role

To recover the purged emails, the admin account must have the Mailbox Import Export role assigned. In the Exchange admin center, navigate to Roles → Admin Roles → Organization Management. Under the Permissions tab, add Mailbox Import Export, and then click Save to apply the changes.

Note: This method grants the Mailbox Import Export role to all Exchange admins and Global admins since it modifies the Organization Management role group. To limit access, consider creating a new role group and assigning only the required admins.

You can recover deleted messages in a user’s mailbox in Exchange Online in two ways:

• Restore deleted messages in user’s mailbox using Exchange admin center (EAC)
• Restore deleted messages in user’s mailbox using PowerShell

The Exchange admin center provides a graphical interface to recover deleted messages with ease. Follow these steps:

1. Sign in to the Exchange admin center.
2. Navigate to Recipients > Mailboxes.
3. Choose the mailbox from which you want to recover deleted messages.
4. Switch to Others tab and click on Recover deleted items to view all the deleted emails that can be retrieved.
   
   Note: The option to ‘Recover deleted items’ may appear greyed out or inaccessible unless the Mailbox Import Export role is assigned to your admin account.
5. The UI will automatically take you to the latest 50 recoverable items. Use the available filters like Time, Subject, Item type, and folder type to locate the email messages you need to restore to the particular mailbox.
6. Select the required messages and click Recover deleted items to restore them to their original folders.

Apart from Exchange admin center, you can also use PowerShell to manage deleted items in Microsoft 365.

Before executing any PowerShell commands, connect to Exchange Online PowerShell.

You can use filters to narrow down recoverable items by subject, type, and date range. This helps identify the exact email(s) you need to restore.

Sure! Here’s a shorter version:

To list emails deleted from Laura’s mailbox between March 1–15, 2025, along with key details, use the following command:

Get-RecoverableItems -Identity "[email protected]" -FilterStartTime "3/1/2025 12:00:00 AM" -FilterEndTime "3/15/2025 11:59:59 PM" | Format-Table Subject, Identity, LastParentPath, ItemClass, EntryID -Wrap -AutoSize 

After identifying the items, restore them using the same filters.

Restore-RecoverableItems -Identity "[email protected]" -FilterStartTime "3/1/2025 12:00:00 AM" -FilterEndTime "3/15/2025 11:59:59 PM" | Format-Table Subject, Identity, LastParentPath, ItemClass, EntryID -Wrap -AutoSize 

This restores only the filtered messages back to their original folder in Laura’s mailbox.

Admins can narrow down recoverable messages by applying filters such as subject keywords, message type, and specific date ranges.

For example, to retrieve emails from Laura’s mailbox that have the subject “MoreToGrow Marketing” and were deleted between March 1, 2025, and March 15, 2025.

Get-RecoverableItems -Identity [email protected] -SubjectContains "MoreToGrow Marketing" -FilterItemType IPM.Note -FilterStartTime "3/1/2025 12:00:00 AM" -FilterEndTime "3/15/2025 11:59:59 PM" 

This command retrieves all recoverable messages that contain the subject “MoreToGrow Marketing“ in the mailbox [email protected] within the specified date range.

To restore the filtered item, replace the ‘Get-RecoverableItems’ cmdlet with ‘Restore-RecoverableItems’.

To restore all recoverable deleted messages from a user mailbox, you can run Restore-RecoverableItems cmdlet.

Restore-RecoverableItems -Identity [email protected]m -ResultSize Unlimited 

While this approach is quick and restores everything in one go, it has a key disadvantage — it can create confusion and clutter in the user’s mailbox by restoring unwanted or outdated emails, potentially overwhelming the inbox.

• Hard deleted email messages can only be retrieved only if the deleted item retention period has not expired.
• When the recoverable items warning quota is reached before the retention period ends, messages are deleted on a first in, first out (FIFO) basis.
• Unlike deleted emails, calendar items are purged after 120 days instead of 14 days.
• Deleted emails can be restored to their original folders within the user’s mailbox. However, exporting them for audit or investigation purposes requires the use of eDiscovery.
• If you specifically need to check who deleted emails from a shared mailbox, you can use a PowerShell script to retrieve a list of the deletion actions.

Recovering deleted emails in Exchange Online is a crucial administrative capability that ensures data integrity and business continuity. By following the outlined steps, administrators can ensure seamless email recovery and minimize data loss risks.

Feel free to reach us using the comments section for any queries.