How to recover deleted emails in Microsoft 365 (Office 365)?

[Update]: This post was last updated on June 11, 2024 to reflect the latest developments in the Microsoft Defender XDR (Microsoft 365 Defender) portal user interface.

Although mailbox data in Microsoft 365 is fairly secure, it does not mean it is protected from deletion. Users, either by accident or on purpose, can remove their emails from the Inbox and Deleted Items folders or even purge them from the Recoverable Items folder. What’s more, there might be retention policies, which live only for deleting certain emails from users’ mailboxes. Fortunately, Microsoft 365 gives you “Plan B”, just in case you would need to recover deleted emails. This plan, however, only works when the time gap between deletion and recovery is not too big.

Recover deleted emails in Microsoft 365

So, what options do you have when a user comes to you begging for help with recovering deleted emails in Microsoft 365?

Native options to recover deleted items in Microsoft 365

In Microsoft 365, there are two ways of recovering a deleted email. The first one involves users who can recover deleted emails by themselves using the built-in recovery options. The second option requires some help from an administrator to search for a deleted email using eDiscovery. Below you will find instructions on how to proceed in either way.

Recover deleted emails in Microsoft 365 – instruction for users

In many cases, users can recover a deleted email by themselves within their Microsoft 365 account. Once a user has noticed that they accidentally deleted an email, they can restore it directly from the Deleted Items folder. If the email was e.g. hard deleted (using the Shift+Delete key combination) or removed from the Deleted Items folder by a user or retention policy, it needs to be recovered from the Recoverable Items folder. Follow the steps below to recover deleted items from the Deleted Items folder or Recoverable Items folder:

Method 1: Recover emails from the Deleted Items folder:

  1. Sign in to Outlook on the web.
  2. On the left folder pane, go to the Deleted Items folder and click on it.
  3. In the Deleted Items folder, find the message you want to restore and right click it. In the window that opens, use the Restore or Move options to recover a deleted item.restore deleted items Microsoft 365
  4. Now, the deleted email should be moved back to your Inbox.

But what if a deleted email is not present in the Deleted Items folder anymore? Then, you can search for that email in the Recoverable Items folder. You can reach it by clicking the Recover items deleted from this folder button.
Restore purged items Outlook on the web

Method 2: Recover items from the Recoverable Items folder:

  1. In Outlook on the web, open the Deleted Items folder and click the Recover items deleted from this folder link.
  2. In the Recoverable Items window, find an email you want to recover, right click it, and then click Restore. If you need to recover more emails at once, you can select them by checking a checkbox next to each email.
    restore purged items in Outlook on the web
  3. All selected emails should appear in your Inbox.

There also might be a situation when a user cannot find a deleted email in their Microsoft 365 mailbox. If that’s the case, an admin intervention might be needed.

Recover deleted items in Microsoft 365 – instruction for administrators

If a user was not able to recover deleted emails from their Microsoft 365 mailbox, you can do it directly in Exchange Online using eDiscovery (you have to be a global administrator in Microsoft 365 to proceed). To recover deleted emails, follow the steps below:

Important: You can recover emails only if they had not been purged from the user’s mailbox. In other words, you can recover deleted emails if they are still available in the Recoverable Items folder. If they’re not, you might not be able to recover those emails. Features like a litigation hold can prevent items from being permanently deleted.

  1. Sign in to the Microsoft Defender XDR portal.
  2. Go to SystemPermissions and click Roles under Email & collaboration roles. A list of all available role groups will be displayed. Select the eDiscovery Manager role group.
    Adding an eDiscovery Administratora. In the pane that opens, click Edit to start the eDiscovery Manager wizard. Click Next to move to the Manage eDiscovery Administrator step and add your account there.
    Adding an eDiscovery Administratorb. Complete the wizard, sign out and sign in again to Microsoft 365, so that the changes take effect.
  3. Once you have assigned the necessary permissions to your account, sign in to the Microsoft Purview compliance portal, go to Content search, and click the New search button.
    Creating a new content search
  4. Name your search and go to Locations. Choose locations (e.g. Exchange mailboxes) to search in by using a toggle switch. Once you choose a location, you will be able to narrow down your search to specific groups, users, etc.
    Configuring content search query
  5. Next, go to the Conditions step of the wizard. Here you can make your search return even more granular results by e.g. specifying query language, entering keywords, or adding specific conditions (e.g. date range, recipient, message type, etc.) with the Add condition button.
    Define content search conditions
  6. Review your search settings and click Submit & Done to add it to the Search tab and run it immediately.
  7. You can check the status of your search by clicking it. Once it’s finished, click it once again, click the Actions button (on the Summary tab), and then choose the Export results option.Export search results in eDisovery
  8. Leave the default options as they are and click Export.
    Generate results in eDiscovery
  9. On the Export tab, find the newly created export item, click it and click Download results.
    Download results
  10. Once everything is ready for download, you can launch the eDiscovery Export Tool. Here, you need to paste the export key (use the Copy to clipboard button to get it) and select the location to download PST files.
    How to use eDiscovery Export tool
  11. After selecting a location for the PST file, click Start to download the file to your computer.
  12. Now, it’s time to open recovered emails from the PST file in a user’s mailbox. To complete this step, you can either advise a user on how to do it or import the file yourself. To proceed, you need a desktop version of Outlook as Outlook on the web (OWA) does not open PST files. To start, open your Outlook, and go to the File tab. Then, click Open & Export > Open Outlook Data File.Open Outlook data file in Outlook 2016, 2013 or 2010.
  13. In the window that opens, search for the PST file that contains recovered emails, select it, and click OK.Select the PST file to open it in Outlook
  14. Now, you should see a new folder tree in your Outlook. Expand that new PST file using the arrow and click the folder from which you want to recover emails. In my example, it is the Inbox folder.Emails opened in Outlook from a PST file.
  15. To recover a selected email, right-click it and then click Move>Other folder…Move deleted emails to other folder
  16. Select a folder and click OK.Move items to Inbox
  17. A deleted email should appear back in your Outlook personal folder.Items recovered to the Inbox folder in Outlook.

Limitations/inconvenience of native solutions

Native options, though helpful, have some limitations that you may found inconvenient when managing deleted data. Take a look at the list below to learn more:

  • If a folder has been deleted from Deleted Items, you can recover only single items that the folder included, not the folder itself. It means that emails will be recovered to Inbox, not to the original folder.
  • Permanently deleted emails can be recovered from Recoverable Items within 14 days (by default) or 30 days (option for Exchange Online mailboxes – you need to remember to set up the 30-day retention first). After that time, emails can’t be recovered.
  • Emails purged from the Recoverable Items folder can’t be recovered.
  • To extend a retention period to more than 30 days, you need to place a mailbox on In-Place Hold or Litigation Hold.
  • In-Place Hold is a premium feature, which requires the Exchange Online Plan 2 or Exchange Online Archiving license.
  • Deleted emails found by eDiscovery are not recovered directly to an original location – you need to export them to a PST file first and then import to the user’s mailbox (or ask a user to do that themselves).
  • Recovered emails imported via a PST file are not imported directly to their original folders – they need to be moved manually to corresponding folders.
  • To restore deleted emails using a PST file, you need to use a desktop version of Outlook (Outlook on the web does not open PST files).
  • To view deleted emails in the Recovery Items folder, you need to copy eDiscovery results to a discovery mailbox.
  • The procedure can be considered time consuming

Email recovery with a third-party tool – CodeTwo Backup for Office 365

If native solutions do not exactly meet your requirements, you need to use a third-party tool like CodeTwo Backup for Office 365. The application overcomes native limitations allowing you to manage email recovery process in an easier and faster manner.


Back up Office 365 data with CodeTwo Backup for Office 365

Below I have listed some of the advantages that come with CodeTwo Backup for Office 365 and help to overcome native limitations:

  • Offline access to deleted items.
  • Even if an email has been permanently deleted from a mailbox, it still can be recovered from your offline backup copy.
  • If a user deleted an entire folder, you can restore that folder with all emails in it.
  • Deleted emails can be restored from the program’s console directly to users’ mailboxes – there is no need to export search results to a PST file, and then import them to a mailbox via Outlook.
  • You can preview email content before recovering it.

How to recover emails with CodeTwo Backup for Office 365

To recover deleted emails using a CodeTwo Backup application, you first need to make sure you created a backup copy of your emails. Backed up emails are stored on your local drive, so you can access them at any time, even if you are offline. Every time a user deletes an email, either by accident or on purpose, you can search backup copies and recover missing emails immediately.

So how to recover deleted emails in Microsoft 365 using CodeTwo Backup program? Follow the instruction below to learn more.

Note: I have already created backup copies of my emails using CodeTwo Backup. To see how to do this, follow this link.

  1. To start a restore job, open the CodeTwo Backup console and click on the Backups tab.The Backups tab in CodeTwo Backup for Office 365
  2. In the Backups tab, select a storage that contains a mailbox you want to search.Select a storage to search
  3. Once you have selected a storage, you should see a list of mailboxes available within that storage. They are displayed on the left-hand side of the console.Mailboxes included within a storage are listed in the program's console.
  4. Find the mailbox you want to search and click on the plus icon next to it to expand the folder tree. Then, click Inbox to see the list of emails. Note: When you click on a specific email in the middle pane, you will see its preview in the right-hand side pane.Emails preview in CodeTwo Backup
  5. To search emails, you can also use a built-in search engine. It gives you various criteria to select from.Search emails using a wide range of criteria available in CodeTwo Backup.
  6. When you have found emails you want to recover, you can preview them in the right-hand pane. Additionally, you can check the time when an email was created, modified or deleted. If a user removed an email, its removed version will appear on the list of versions as Deleted on. Note: The Deleted on version only indicates that an email was removed. To recover a deleted email, select its Created on or Modified on version.Versions of backed up emails.
  7. To restore a selected email, right-click on it and then click Restore selected items. Note: You can select more emails to be restored at once by pressing Ctrl or Shift on your keyboard while selecting particular emails.Restore selected emails
  8. Now, the Create restore items job wizard will open. In the first step, provide a name for your restore job. Then, click Next.Create a new restore job
  9. In the Source data section, you can double check details about selected emails.Create a restore job - select source data
  10. It’s time to select a target location for emails you want to recover. Use the Manage button to select a server connection. Then, decide whether to restore the emails to the original location or to an alternative one. Once you have finished, click Next.Create a restore job - select a target location
  11. Now, adjust restore options to your needs. Then, click Next.Create a restore job - restore options
  12. In the Job summary section, you can check details of an already created restore job. If everything is fine, click Finish.Create a restore job - job summary
  13. The job will not start automatically so the application will ask you whether you want to start the job now. Click Yes to start the restore process (or No if you prefer to start that job later – you can do it from the Jobs tab).Start a restore job
  14. To monitor the restore job progress, go to the Jobs tab, find your restore job, and click on it. All details regarding that process will display in the lower pane.Jobs tab - restore job
  15. Once the job has finished, access the mailbox to view recovered emails.

And that’s it! The process is very simple and doesn’t take much time. You do not have to play with PST files, and what’s even more appealing, there is no need to engage end users in the process. The entire recovery process can be done with just a few clicks from one place.

Suggested reading:

Tools for Exchange Server

9 thoughts on “How to recover deleted emails in Microsoft 365 (Office 365)?


  1. thanks to the author for the article. I will add two points: if you need to export with a pst file, then select “Export Results” also remove your account from the eDiscovery Administrator group and add it to the eDiscovery Manager so as not to catch “failed with status code 500” and of course do not specify a period greater than 90 days otherwise – failed with status code 500 :)

  2. Question. This program recovers deleted emails past the 30 day threshold without setting up a litigation hold (or purchasing an exchange online plan 2 license)…how does it stack up cost wise to those licenses? Thanks.

    • Currently, basing on the Microsoft’s plan comparison site, when annual commitment is chosen, Exchange Online plan 1 license is $4 per user per month, while Exchange Online plan 2 license is $8. For 100 users, that’s $4800 difference between plans per year. CodeTwo Backup for Office 365 has a dynamic pricing plan – the more users you back up, the lower the cost per user is. For 100 users, a complete cost for an annual subscription is $ 1,019.00. You can read more and calculate the cost at CodeTwo Backup’s pricing page.

    • No, they are not required. The backup or archive keywords are added only as a sample. As far as I know, there is no “only deleted items” filter in eDiscovery, yet.

  3. Yes thank you for your answer. To Answer your questions:
    No old mails were just on this machine, Outlook it didn’t sync with server that was the problem thats fixed.
    I fixed the sync by editing existing, not creating new profile, by editing root folder path to “Inbox” then syncing, then deleting root folder path and then syncing again, which worked.
    Dont know about old PST files, have to check, should they be there after this sync.
    Other then webserver which doesnt have that mails none.

  4. Hello,

    Does anyone know how to recover emails after sync? I had account that didn’t sync with web server, than I fixed it and now it synced everything from web server but old mails are gone, its Outlook 2016.

    • Hello,
      I’m afraid there are too many unknowns to answer your question.
      Are the old emails available on the server? Or were they only in Outlook? How did you fix the sync? Was it by recreating an Outlook profile? Are there any old OST/PST files available? Did you have any kind of backup?

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

*

CodeTwo sp. z o.o. sp. k. is a controller of your personal data.
See our Privacy Policy to learn more.