Update: This article was updated on July 26, 2021.
If you’re a Microsoft 365 admin, it’s only a matter of time before you’re tasked with recovering deleted email (or other mailbox items). While you can use eDiscovery to recover deleted items, there’s an easier way that lets you recover deleted items directly to their place of origin. Below I describe how to recover deleted mailbox items of Microsoft 365 users using PowerShell and using the Modern Exchange Admin Center (EAC). And for dessert, I’ll show you how to restore public folders that have been deleted from the organization.
But first, it’s important to understand what happens to deleted emails in Microsoft 365.
What happens to deleted items in Microsoft 365
There are 3 levels of “erasure” from which items can be recovered:
First, when an element is removed with Clear button (or right-click > Delete), it goes to the Deleted Items folder. In other words, it’s the recycle bin of the default mailbox. Users can easily access and restore such items using their Outlook desktop app or Outlook on the web.
Next, when an item is deleted from the Deleted Items folder, it is soft-deleted, meaning it is moved to the Recoverable Items folder. An e-mail also goes there after a user has deleted it with change+Clear keyboard shortcut. While the user can recover an email from there, once the retention period expires, it will be permanently removed. By default, the period is 14 days but can be extended to a maximum of 30 days.
Finally, when a user deletes an email from the Recoverable Items folder, it enters the permanently deleted state. In Exchange Online, the item is placed in a hidden Deletions folder, which is a Recoverable Items subfolder that users cannot access (items from this folder can only be accessed and recovered by a Microsoft 365 admin will).
Exchange Online uses the managed folder assistant to automatically delete items from the Purges folder. You can also use Search-Mailbox with the -DeleteContent switch to permanently delete items. Both methods result in emails being irretrievably removed. In this case, the only way to recover deleted items is to restore them from a backup.
When a mailbox is on Litigation Hold, emails and other items aren’t permanently deleted from the Recoverable Items folders. Provided you have the correct license for the user, you can recover the deleted items.
Read more about Microsoft 365 litigation holds and retention policies
How to recover deleted Microsoft 365 items using PowerShell
Before you start the recovery process, make sure you’re assigned the Mailbox Import Export role in Exchange Online and connect to Exchange Online using PowerShell.
To restore deleted items to their original mailboxes, use the following two cmdlets: Get-RecoverableItems to find the right items and Restore-RecoverableItems to put them back in their original folders (or Inbox if those folders are no longer accessible).
Check out the most common uses of the Get-RecoverableItems cmdlet in the following examples:
To search for all deleted items from a user’s mailbox, use:
Get-RecoverableItems -Identity meganb | select identity, subject, lastmodifiedtime, itemclass
To find emails deleted only in the last two days:
Get-RecoverableItems meganb -FilterStartTime (get-date).adddays(-2) -FilterItemType IPM.Note | select Identity,Subject,LastmodifiedTime
You can easily search all mailboxes for specific messages. In this case, it is best to use a detailed search query. This way the cmdlet doesn’t produce an overwhelming number of results:
$mailboxes=(get-mailbox)
foreach ($mailbox in $mailboxes) {Get-RecoverableItems $mailbox -SubjectContains "audit" -FilterStartTime (get-date).adddays(-2) -FilterItemType IPM.Note | select Identity,Subject,LastmodifiedTime}
The easiest way to recover this data is to add Restore-RecoverableItems in a pipeline followed by the query that finds the items to recover:
Get-RecoverableItems -Identity lynner -SubjectContains "audit" | Restore-RecoverableItems
You can also use the Restore-RecoverableItems cmdlet independently. For example, to recover all items deleted by specific users, run:
Restore-RecoverableItems -Identity “user1”, “user2”
The Restore-RecoverableItems cmdlet accepts more than one value of the Identity parameter (separated by commas) and has filters similar to the Get-RecoverableItems cmdlet.
Recover deleted items in the Modern Exchange admin center
The Modern Exchange admin center in Microsoft 365 includes an option to recover deleted items using the UI instead of PowerShell. This option isn’t available in the Classic Exchange admin center.
To recover deleted items, go to Modern Exchange Admin Center > Recipients > Mailboxes, select the user whose mailbox items you want to restore and click Recover Deleted Items:
Use the filters in the next window to search for specific subject lines, choose what type of item to search for and which folder you want to search. When you are finished specifying your search criteria, highlight the items to recover and click Recover deleted items Button.
There is currently no way to search for messages in multiple mailboxes at the same time.
And that’s it. As simple (or complex if you prefer) as this is how you can recover deleted items.
Recover deleted public folders
Public folders are a special feature of Exchange Online. While some businesses can leave without even knowing public folders exist, others rely heavily on them and their collaboration skills. A public folder can contain emails, posts, and documents. With the right permissions, deleting a public folder is now easy. The surprising thing is that there is no way to restore it EAC – You have to resort to PowerShell. That’s how you do it:
- First, connect to Exchange-Online (here’s how to do it) and run the following cmdlet to find out if there are any recently deleted public folders:
Get-PublicFolder \NON_IPM_SUBTREE\DUMPSTER_ROOT -Recurse |?{$_.FolderClass -ne "$null"}
- If the deleted public folder has an active eDiscovery (Litigation) hold, you must navigate to a different Dumpster location. Additionally, instead of searching for all public folders, you can filter the results by the name of the deleted folder:
Get-PublicFolder \NON_IPM_SUBTREE\DISCOVERYHOLDS -Recurse |?{$_.Name -like "IT"}
- To recover all deleted public folders returned by any of the above cmdlets, forward the results to:
… | Set-PublicFolder -Path \
Where -Path specifies the parent folder where deleted public folders will be restored (use -Path \ to restore them to the root of the public folder tree).
To recover a specific deleted public folder, you need to provide its exact identity, for example:
Set-PublicFolder -Identity \NON_IPM_SUBTREE\DUMPSTER_ROOT\DUMPSTER_EXTEND\RESERVED_1\RESERVED_1\6d9f59c5-fb2b-46e5-b658-961e9fd336f1 -Path \
Things to note:
But what to do if the native methods are not sufficient?
Back up and restore Microsoft 365 data
The most reliable way to protect your data from accidental or intentional deletion is to use a Microsoft 365 backup tool. Although Microsoft 365 offers some decent recovery options, there are many valid reasons to back up Microsoft 365 mailboxes. Independent, local backup allows you to:
- effectively protect against accidental data loss,
- reduce the risk of intentional data deletion,
- keep full access to your data,
- comply with legal requirements.
CodeTwo Backup for Office 365 is a solution that allows you to backup and restore Microsoft 365 data, including mailboxes, public folders, SharePoint Online, OneDrive for Business and Microsoft Teams data. In addition to the general advantages mentioned above, the tool offers you the following advantages:
- unlimited backup and archiving of Microsoft 365 data,
- Support for mailboxes in every Exchange Online plan,
- full accessibility of your cloud data,
- Ability to restore items to their original location or to a different folder, mailbox and even to a different tenant,
- Easily browse versions and search for articles.
Download a free trial
