How to recover deleted emails in Microsoft 365 (Office 365)?

[Update]: This post was last updated on June 11, 2024 to reflect the latest developments in the Microsoft Defender XDR (Microsoft 365 Defender) portal user interface.

Although mailbox data in Microsoft 365 is fairly secure, it does not mean it is protected from deletion. Users, either by accident or on purpose, can remove their emails from the Inbox and Deleted Items folders or even purge them from the Recoverable Items folder. What’s more, there might be retention policies, which live only for deleting certain emails from users’ mailboxes. Fortunately, Microsoft 365 gives you “Plan B”, just in case you would need to recover deleted emails. This plan, however, only works when the time gap between deletion and recovery is not too big.

So, what options do you have when a user comes to you begging for help with recovering deleted emails in Microsoft 365?

Native options to recover deleted items in Microsoft 365

In Microsoft 365, there are two ways of recovering a deleted email. The first one involves users who can recover deleted emails by themselves using the built-in recovery options. The second option requires some help from an administrator to search for a deleted email using eDiscovery. Below you will find instructions on how to proceed in either way.

• Recover deleted emails in Microsoft 365 – user’s instruction
• Recover deleted emails in Microsoft 365 – admin’s instruction

Recover deleted emails in Microsoft 365 – instruction for users

In many cases, users can recover a deleted email by themselves within their Microsoft 365 account. Once a user has noticed that they accidentally deleted an email, they can restore it directly from the Deleted Items folder. If the email was e.g. hard deleted (using the Shift+Delete key combination) or removed from the Deleted Items folder by a user or retention policy, it needs to be recovered from the Recoverable Items folder. Follow the steps below to recover deleted items from the Deleted Items folder or Recoverable Items folder:

Method 1: Recover emails from the Deleted Items folder:

1. Sign in to Outlook on the web.
2. On the left folder pane, go to the Deleted Items folder and click on it.
3. In the Deleted Items folder, find the message you want to restore and right click it. In the window that opens, use the Restore or Move options to recover a deleted item.
4. Now, the deleted email should be moved back to your Inbox.

But what if a deleted email is not present in the Deleted Items folder anymore? Then, you can search for that email in the Recoverable Items folder. You can reach it by clicking the Recover items deleted from this folder button.


Method 2: Recover items from the Recoverable Items folder:

1. In Outlook on the web, open the Deleted Items folder and click the Recover items deleted from this folder link.
2. In the Recoverable Items window, find an email you want to recover, right click it, and then click Restore. If you need to recover more emails at once, you can select them by checking a checkbox next to each email.
   
3. All selected emails should appear in your Inbox.

There also might be a situation when a user cannot find a deleted email in their Microsoft 365 mailbox. If that’s the case, an admin intervention might be needed.

Recover deleted items in Microsoft 365 – instruction for administrators

If a user was not able to recover deleted emails from their Microsoft 365 mailbox, you can do it directly in Exchange Online using eDiscovery (you have to be a global administrator in Microsoft 365 to proceed). To recover deleted emails, follow the steps below:

Important: You can recover emails only if they had not been purged from the user’s mailbox. In other words, you can recover deleted emails if they are still available in the Recoverable Items folder. If they’re not, you might not be able to recover those emails. Features like a litigation hold can prevent items from being permanently deleted.

1. Sign in to the Microsoft Defender XDR portal.
2. Go to System > Permissions and click Roles under Email & collaboration roles. A list of all available role groups will be displayed. Select the eDiscovery Manager role group.
   a. In the pane that opens, click Edit to start the eDiscovery Manager wizard. Click Next to move to the Manage eDiscovery Administrator step and add your account there.
   b. Complete the wizard, sign out and sign in again to Microsoft 365, so that the changes take effect.
3. Once you have assigned the necessary permissions to your account, sign in to the Microsoft Purview compliance portal, go to Content search, and click the New search button.
   
4. Name your search and go to Locations. Choose locations (e.g. Exchange mailboxes) to search in by using a toggle switch. Once you choose a location, you will be able to narrow down your search to specific groups, users, etc.
   
5. Next, go to the Conditions step of the wizard. Here you can make your search return even more granular results by e.g. specifying query language, entering keywords, or adding specific conditions (e.g. date range, recipient, message type, etc.) with the Add condition button.
   
6. Review your search settings and click Submit & Done to add it to the Search tab and run it immediately.
7. You can check the status of your search by clicking it. Once it’s finished, click it once again, click the Actions button (on the Summary tab), and then choose the Export results option.
8. Leave the default options as they are and click Export.
   
9. On the Export tab, find the newly created export item, click it and click Download results.
   
10. Once everything is ready for download, you can launch the eDiscovery Export Tool. Here, you need to paste the export key (use the Copy to clipboard button to get it) and select the location to download PST files.
    
    
11. After selecting a location for the PST file, click Start to download the file to your computer.
12. Now, it’s time to open recovered emails from the PST file in a user’s mailbox. To complete this step, you can either advise a user on how to do it or import the file yourself. To proceed, you need a desktop version of Outlook as Outlook on the web (OWA) does not open PST files. To start, open your Outlook, and go to the File tab. Then, click Open & Export > Open Outlook Data File.
13. In the window that opens, search for the PST file that contains recovered emails, select it, and click OK.
14. Now, you should see a new folder tree in your Outlook. Expand that new PST file using the arrow and click the folder from which you want to recover emails. In my example, it is the Inbox folder.
15. To recover a selected email, right-click it and then click Move>Other folder…
16. Select a folder and click OK.
17. A deleted email should appear back in your Outlook personal folder.

Limitations/inconvenience of native solutions

Native options, though helpful, have some limitations that you may found inconvenient when managing deleted data. Take a look at the list below to learn more:

• If a folder has been deleted from Deleted Items, you can recover only single items that the folder included, not the folder itself. It means that emails will be recovered to Inbox, not to the original folder.
• Permanently deleted emails can be recovered from Recoverable Items within 14 days (by default) or 30 days (option for Exchange Online mailboxes – you need to remember to set up the 30-day retention first). After that time, emails can’t be recovered.
• Emails purged from the Recoverable Items folder can’t be recovered.
• To extend a retention period to more than 30 days, you need to place a mailbox on In-Place Hold or Litigation Hold.
• In-Place Hold is a premium feature, which requires the Exchange Online Plan 2 or Exchange Online Archiving license.
• Deleted emails found by eDiscovery are not recovered directly to an original location – you need to export them to a PST file first and then import to the user’s mailbox (or ask a user to do that themselves).
• Recovered emails imported via a PST file are not imported directly to their original folders – they need to be moved manually to corresponding folders.
• To restore deleted emails using a PST file, you need to use a desktop version of Outlook (Outlook on the web does not open PST files).
• To view deleted emails in the Recovery Items folder, you need to copy eDiscovery results to a discovery mailbox.
• The procedure can be considered time consuming

Email recovery with a third-party tool – CodeTwo Backup for Office 365

If native solutions do not exactly meet your requirements, you need to use a third-party tool like CodeTwo Backup for Office 365. The application overcomes native limitations allowing you to manage email recovery process in an easier and faster manner.

Below I have listed some of the advantages that come with CodeTwo Backup for Office 365 and help to overcome native limitations:

• Offline access to deleted items.
• Even if an email has been permanently deleted from a mailbox, it still can be recovered from your offline backup copy.
• If a user deleted an entire folder, you can restore that folder with all emails in it.
• Deleted emails can be restored from the program’s console directly to users’ mailboxes – there is no need to export search results to a PST file, and then import them to a mailbox via Outlook.
• You can preview email content before recovering it.

How to recover emails with CodeTwo Backup for Office 365

To recover deleted emails using a CodeTwo Backup application, you first need to make sure you created a backup copy of your emails. Backed up emails are stored on your local drive, so you can access them at any time, even if you are offline. Every time a user deletes an email, either by accident or on purpose, you can search backup copies and recover missing emails immediately.

So how to recover deleted emails in Microsoft 365 using CodeTwo Backup program? Follow the instruction below to learn more.

Note: I have already created backup copies of my emails using CodeTwo Backup. To see how to do this, follow this link.

1. To start a restore job, open the CodeTwo Backup console and click on the Backups tab.
2. In the Backups tab, select a storage that contains a mailbox you want to search.
3. Once you have selected a storage, you should see a list of mailboxes available within that storage. They are displayed on the left-hand side of the console.
4. Find the mailbox you want to search and click on the plus icon next to it to expand the folder tree. Then, click Inbox to see the list of emails. Note: When you click on a specific email in the middle pane, you will see its preview in the right-hand side pane.
5. To search emails, you can also use a built-in search engine. It gives you various criteria to select from.
6. When you have found emails you want to recover, you can preview them in the right-hand pane. Additionally, you can check the time when an email was created, modified or deleted. If a user removed an email, its removed version will appear on the list of versions as Deleted on. Note: The Deleted on version only indicates that an email was removed. To recover a deleted email, select its Created on or Modified on version.
7. To restore a selected email, right-click on it and then click Restore selected items. Note: You can select more emails to be restored at once by pressing Ctrl or Shift on your keyboard while selecting particular emails.
8. Now, the Create restore items job wizard will open. In the first step, provide a name for your restore job. Then, click Next.
9. In the Source data section, you can double check details about selected emails.
10. It’s time to select a target location for emails you want to recover. Use the Manage button to select a server connection. Then, decide whether to restore the emails to the original location or to an alternative one. Once you have finished, click Next.
11. Now, adjust restore options to your needs. Then, click Next.
12. In the Job summary section, you can check details of an already created restore job. If everything is fine, click Finish.
13. The job will not start automatically so the application will ask you whether you want to start the job now. Click Yes to start the restore process (or No if you prefer to start that job later – you can do it from the Jobs tab).
14. To monitor the restore job progress, go to the Jobs tab, find your restore job, and click on it. All details regarding that process will display in the lower pane.
15. Once the job has finished, access the mailbox to view recovered emails.

And that’s it! The process is very simple and doesn’t take much time. You do not have to play with PST files, and what’s even more appealing, there is no need to engage end users in the process. The entire recovery process can be done with just a few clicks from one place.

Suggested reading:

• Offline backup and restore solution for Office 365 mailboxes
• Find out more about CodeTwo Backup for Office 365
• SharePoint Online and OneDrive for Business Backup