How to recover deleted emails in Office 365?

[Update]: This post was updated on July 06, 2020.

Although mailbox data in Office 365 is fairly secure, it does not mean it is protected from deletion. Users, either by accident or on purpose, can remove their emails from the Inbox and Deleted Items folders or even purge them from the Recoverable Items folder. What’s more, retention policies can exist, which live only for deleting certain emails from users’ mailboxes. Of course, Office 365 gives you “Plan B”, just in case you would need to recover deleted emails. This plan, however, only works when the time gap between deletion and recovery is not too big.

Recover deleted emails in Office 365.

So, what options do you have when a user comes to you begging for help with recovering deleted emails in Office 365?

Native options to recover deleted items in Office 365

In Office 365, there are two ways of recovering a deleted email. The first one involves users who can recover deleted emails by themselves using the built-in recovery options. The second option requires some help from an administrator to search for a deleted email using eDiscovery. Below you will find instructions on how to proceed in either way.

Recover deleted emails in Office 365 – instruction for users

In many cases, users can recover a deleted email by themselves within their Office 365 account. Once a user has noticed that they accidentally deleted an email, he or she can restore it directly from the Deleted Items folder. If the email was e.g. hard deleted (using the Shift+Delete key combination) or removed from the Deleted Items folder by a user or retention policy, it needs to be recovered from the Recoverable Items folder. Follow the steps below to recover deleted items from the Deleted Items folder or Recoverable Items folder:

Method 1: Recover emails from the Deleted Items folder:

  1. In your Office 365 account, go to Outlook on the web.Open Outlook on the web
  2. On the left folder pane, go to the Deleted Items folder and click on it.
  3. In the Deleted Items folder, find the message you want to restore and right click it. In the window that opens, use the Restore or Move options to recover a deleted item.restore deleted items Microsoft 365
  4. Now, the deleted email should be moved back to your Inbox.

But what if a deleted email is not present in the Deleted Items folder anymore? Then, you can search for that email in the Recoverable Items folder. You can reach it by clicking the Recover items deleted from this folder button.
Restore purged items Outlook on the web

Method 2: Recover items from the Recoverable Items folder:

  1. In Outlook on the web, open the Deleted Items folder and click the Recover items deleted from this folder link.
  2. In the Recover deleted items window, find an email you want to recover, right click it, and then click Restore. If you need to recover more emails at once, you can select them by checking a checkbox next to each email.
    restore purged items in Outlook on the web
  3. All selected emails should appear in your Inbox.

There also might be a situation when a user cannot find a deleted email in their Office 365 mailbox. If that is the case, a user may ask you to recover missing emails.

Recover deleted items in Office 365 – instruction for administrators

If a user was not able to recover deleted emails from their Office 365 mailbox, you can do it directly in Exchange Online using eDiscovery (you have to be a global administrator in Office 365 to proceed). To recover deleted emails, follow the step below:

Important: You can recover emails only if they had not been purged from the user’s mailbox. In other words, you can recover deleted emails if they are still available in the Recoverable Items folder. If they’re not, you will not recover those emails.

  1. Before you will be able to follow this procedure, make sure that you have sufficient rights to perform an eDiscovery search. To check that:
    a.  Log in to your Office 365 account and go to the app view. Click the Admin app.Microsoft 365 admin center
    b. On the left pane, extend Admin centers and click Security to open the relevant admin center.
    Access Office 365 Security & Compliance Center
    c. In the Security & Compliance center, go to Permissions and edit the eDiscovery Manager role group.
    eDiscovery Manager permissions
    d. Click edit, next to the eDiscovery Administrator group and add your account there.
    e. Now, sign out and sign in again to Office 365, so that the changes take effect.
  2. Once you have assigned the necessary permissions to your account, go to the Search > Content search.
    How to export Office 365 mailboxes to pst - Content Search
  3. Create a new search by clicking the New search button.new content search in eDiscovery
  4. Using the Add conditions button (1), you can specify your search query. Clicking Modify (2) allows you to choose certain groups or users for whom the search will be performed.
    Modify search query
  5. Clicking the Save & run button at the bottom will let you enter the name and description for your search and run it immediately.save & run search
  6. Once you refresh the Searches tab, your search should become available. Click your search and then choose the Export report option.
    export search report in eDisovery
  7. Then, click Generate report.
    generate report
  8. In the Exports tab, find the newly created export item, click it and click Download report.
    download report
  9. Once everything is ready to download, you can launch the eDiscovery Export Tool. Here, you need to paste the export key (use the Copy to clipboard button to get it) and select the location to download PST files.
    eDiscovery Export tool
  10. After selecting a location for the PST file, click Start to download the file to your computer.
  11. Now, it’s time to open recovered emails from the PST file in a user’s mailbox. To complete this step, you can either advise a user on how to do it or import the file yourself. To proceed, you need a desktop version of Outlook as Outlook on the web (OWA) does not open PST files. To start, open your Outlook, and go to the File tab. Then, click Open & Export > Open Outlook Data File.Open Outlook data file in Outlook 2016, 2013 or 2010.
  12. In the window that opens, search for the PST file that contains recovered emails, select it, and click OK.Select the PST file to open it in Outlook
  13. Now, you should see a new folder tree in your Outlook. Expand that new PST file using the arrow and click the folder from which you want to recover emails. In my example, it is the Inbox folder.Emails opened in Outlook from a PST file.
  14. To recover a selected email, right-click it and then click Move>Other folder…Move deleted emails to other folder
  15. Select a folder and click OK.Move items to Inbox
  16. A deleted email should appear back in your Outlook personal folder.Items recovered to the Inbox folder in Outlook.

Limitations/inconvenience of native solutions

Native options, though helpful, have some limitations that you may found inconvenient when managing deleted data. Take a look at the list below to learn more:

  • If a folder has been deleted from Deleted Items, you can recover only single items that the folder included, not the folder itself. It means that emails will be recovered to Inbox, not to the original folder.
  • Permanently deleted emails can be recovered from Recoverable Items within 14 days (by default) or 30 days (option for Exchange Online mailboxes – you need to remember to set up the 30-day retention first). After that time, emails can’t be recovered.
  • Emails purged from the Recoverable Items folder can’t be recovered.
  • To extend a retention period to more than 30 days, you need to place a mailbox on In-Place Hold or Litigation Hold.
  • In-Place Hold is a premium feature, which requires the Exchange Online Plan 2 or Exchange Online Archiving license.
  • Deleted emails found by eDiscovery are not recovered directly to an original location – you need to export them to a PST file first and then import to the user’s mailbox (or ask a user to do that themselves).
  • Recovered emails imported via a PST file are not imported directly to their original folders – they need to be moved manually to corresponding folders.
  • To restore deleted emails using a PST file, you need to use a desktop version of Outlook (Outlook on the web does not open PST files).
  • To view deleted emails in the Recovery Items folder, you need to copy eDiscovery results to a discovery mailbox.
  • The procedure can be considered time consuming

Email recovery with a third-party tool – CodeTwo Backup for Office 365

If native solutions do not exactly meet your requirements, you need to use a third-party tool like CodeTwo Backup for Office 365. The application overcomes native limitations allowing you to manage email recovery process in an easier and faster manner.


Back up Office 365 data with CodeTwo Backup for Office 365

Below I have listed some of the advantages that come with CodeTwo Backup for Office 365 and help to overcome native limitations:

  • Offline access to deleted items.
  • Even if an email has been permanently deleted from a mailbox, it still can be recovered from your offline backup copy.
  • If a user deleted an entire folder, you can restore that folder with all emails in it.
  • Deleted emails can be restored from the program’s console directly to users’ mailboxes – there is no need to export search results to a PST file, and then import them to a mailbox via Outlook.
  • You can preview email content before recovering it.

How to recover emails with CodeTwo Backup for Office 365

To recover deleted emails using a CodeTwo Backup application, you first need to make sure you created a backup copy of your emails. Backed up emails are stored on your local drive, so you can access them at any time, even if you are offline. Every time a user deletes an email, either by accident or on purpose, you can search backup copies and recover missing emails immediately.

So how to recover deleted emails in Office 365 using CodeTwo Backup program? Follow the instruction below to learn more.

Note: I have already created backup copies of my emails using CodeTwo Backup. To see how to do this, follow this link.

  1. To start a restore job, open the CodeTwo Backup console and click on the Backups tab.The Backups tab in CodeTwo Backup for Office 365
  2. In the Backups tab, select a storage that contains a mailbox you want to search.Select a storage to search
  3. Once you have selected a storage, you should see a list of mailboxes available within that storage. They are displayed on the left-hand side of the console.Mailboxes included within a storage are listed in the program's console.
  4. Find the mailbox you want to search and click on the plus icon next to it to extend the folder tree. Then, click Inbox to see the list of emails. Note: When you click on a specific email in the middle pane, you will see its preview in the right-hand side pane.Emails preview in CodeTwo Backup
  5. To search emails, you can also use a built-in search engine. It gives you various criteria to select from.Search emails using a wide range of criteria available in CodeTwo Backup.
  6. When you have found emails you want to recover, you can preview them in the right-hand pane. Additionally, you can check the time when an email was created, modified or deleted. If a user removed an email, its removed version will appear on the list of versions as Deleted on. Note: The Deleted on version only indicates that an email was removed. To recover a deleted email, select its Created on or Modified on version.Versions of backed up emails.
  7. To restore a selected email, right-click on it and then click Restore selected items. Note: You can select more emails to be restored at once by pressing Ctrl or Shift on your keyboard while selecting particular emails.Restore selected emails
  8. Now, the Create restore items job wizard will open. In the first step, provide a name for your restore job. Then, click Next.Create a new restore job
  9. In the Source data section, you can double check details about selected emails.Create a restore job - select source data
  10. It’s time to select a target location for emails you want to recover. Use the Manage button to select a server connection. Then, decide whether to restore the emails to the original location or to an alternative one. Once you have finished, click Next.Create a restore job - select a target location
  11. Now, adjust restore options to your needs. Then, click Next.Create a restore job - restore options
  12. In the Job summary section, you can check details of an already created restore job. If everything is fine, click Finish.Create a restore job - job summary
  13. The job will not start automatically so the application will ask you whether you want to start the job now. Click Yes to start the restore process (or No if you prefer to start that job later – you can do it from the Jobs tab).Start a restore job
  14. To monitor the restore job progress, go to the Jobs tab, find your restore job, and click on it. All details regarding that process will display in the lower pane.Jobs tab - restore job
  15. Once the job has finished, access the mailbox to view recovered emails.

And that’s it! The process is very simple and doesn’t take much time. You do not have to play with PST files, and what even more appealing, there is no need to engage end users in the process. The entire recovery process can be done with just a few clicks from one place.

Suggested reading:

CodeTwo Products

8 thoughts on “How to recover deleted emails in Office 365?


  1. Question. This program recovers deleted emails past the 30 day threshold without setting up a litigation hold (or purchasing an exchange online plan 2 license)…how does it stack up cost wise to those licenses? Thanks.

    • Currently, basing on the Microsoft’s plan comparison site, when annual commitment is chosen, Exchange Online plan 1 license is $4 per user per month, while Exchange Online plan 2 license is $8. For 100 users, that’s $4800 difference between plans per year. CodeTwo Backup for Office 365 has a dynamic pricing plan – the more users you back up, the lower the cost per user is. For 100 users, a complete cost for an annual subscription is $ 1,019.00. You can read more and calculate the cost at CodeTwo Backup’s pricing page.

    • No, they are not required. The backup or archive keywords are added only as a sample. As far as I know, there is no “only deleted items” filter in eDiscovery, yet.

  2. Yes thank you for your answer. To Answer your questions:
    No old mails were just on this machine, Outlook it didn’t sync with server that was the problem thats fixed.
    I fixed the sync by editing existing, not creating new profile, by editing root folder path to “Inbox” then syncing, then deleting root folder path and then syncing again, which worked.
    Dont know about old PST files, have to check, should they be there after this sync.
    Other then webserver which doesnt have that mails none.

  3. Hello,

    Does anyone know how to recover emails after sync? I had account that didn’t sync with web server, than I fixed it and now it synced everything from web server but old mails are gone, its Outlook 2016.

    • Hello,
      I’m afraid there are too many unknowns to answer your question.
      Are the old emails available on the server? Or were they only in Outlook? How did you fix the sync? Was it by recreating an Outlook profile? Are there any old OST/PST files available? Did you have any kind of backup?

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

*

*