How to recover user emails in Microsoft 365

If you are a Microsoft 365 administrator, it’s only a matter of time before you are tasked with restoring deleted emails (or other mailbox items). While you can use eDiscovery to recover deleted items, there is an easier way which lets you restore deleted items straight back to where they originated from. Below, I’ll describe how to recover deleted Microsoft 365 users’ mailbox items with PowerShell and with the Modern Exchange Admin Center.

Recover Users Emails In Microsoft 365

But first, it is crucial to understand what happens to deleted emails in Microsoft 365.

What happens to deleted items in Microsoft 365

There are 3 levels of “deletion” from which items can be restored:

First, if an item is removed using the delete key (or right-click > delete), it goes to the Deleted Items folder. In other words, it is the standard mailbox’s trash bin. Users can easily access and recover such item using their Outlook desktop app or in Outlook on the web.

Next, if an item is deleted from the Deleted Items folder, it enters a soft-delete state, i.e. it goes to the Recoverable Items folder. That’s also where an email goes after a user deletes it with the shift+delete key combination. While the user can still restore an email from there, it will be permanently removed when the retention period is over. By default, the period is 14 days long, but this can be extended to a maximum of 30 days.

Finally, if a user purges an email from the Recoverable Items folder, it enters the hard-delete state. In Exchange Online, the item is placed in a hidden Purges folder which is the Recoverable Items subfolder which cannot be accessed by users (items from this folder can only be accessed and restored by a Microsoft 365 admin).

Exchange Online uses Managed Folder Assistant to automatically delete items from the Purges folder. You can also use Search-Mailbox with the -DeleteContent switch to permanently delete items. Both methods cause emails to be removed beyond recovery. When this happens, the only way to recover deleted items is to restore them from a backup.

If a mailbox is on litigation hold, emails and other items won’t be permanently deleted from the Recoverable Items folders. Provided you have the right license for the user, you can recover the deleted items.

Read more about Microsoft 365 litigation holds and retention policies

How to recover deleted Microsoft 365 items using PowerShell

Before you start the recovery process, make sure you have the Mailbox Import Export role assigned in Exchange Online and connect to Exchange Online via PowerShell.

To restore deleted items to their original mailboxes, use the following two cmdlets: Get-RecoverableItems to find the right items and Restore-RecoverableItems to put them back in their original folders (or in the inbox if these folders are no longer accessible).

Take a look at the most common applications of the Get-RecoverableItems cmdlet in the examples below:

To search for all deleted items from a user’s mailbox, use:

Get-RecoverableItems -Identity meganb | select identity, subject, lastmodifiedtime, itemclass

To find emails deleted in the last two days only:

Get-RecoverableItems meganb -FilterStartTime (get-date).adddays(-2) -FilterItemType IPM.Note | select Identity,Subject,LastmodifiedTime

You can easily search through all mailboxes for particular messages. In that case, it’s best to use a detailed search query. This way, the cmdlet will not produce an overwhelming number of results:

$mailboxes=(get-mailbox)
foreach ($mailbox in $mailboxes) {Get-RecoverableItems meganb -SubjectContains "audit" -FilterStartTime (get-date).adddays(-2) -FilterItemType IPM.Note | select Identity,Subject,LastmodifiedTime}

The easiest way to recover this data is to add Restore-RecoverableItems in a pipeline, following the query which finds the items to be restored:

Get-RecoverableItems -Identity lynner -SubjectContains "audit" | Restore-RecoverableItems

You can also use the Restore-RecoverableItems cmdlet independently. For example, to restore all items deleted by specific users, run:

Restore-RecoverableItems -Identity “user1”, “user2”

The Restore-RecoverableItems cmdlet accepts more than one value of the Identity parameter (separated with commas) and has similar filters as the Get-RecoverableItems cmdlet.

Recover deleted items in Modern Exchange Admin Center

The Modern Exchange Admin Center in Microsoft 365 includes an option to restore deleted items using the UI instead of PowerShell. This option is not available in the Classic Exchange Admin Center.

To recover deleted items, go to the Modern Exchange Admin Center > Recipients > Mailboxes, choose the user whose mailbox items you want to restore and click Recover deleted items:

Modern Exchange Admin Center - recover deleted items

Use the filters in the next window to search for certain subject lines, choose which item type to look for and which folder to search through. When you are done specifying your search criteria, highlight the items to be restored and click the Recover deleted items button.

Recover deleted items in Modern Exchange Admin Center

Currently, there is no option to search for messages in multiple mailboxes at the same time.

And that’s it. Simple as that (or complex as that if you prefer), this is how you recover deleted items. But what to do if the methods above are insufficient?

Back up Microsoft 365 data

The most reliable way to protect your data against being deleted accidentally or on purpose is to use a Microsoft 365 backup tool. Although Microsoft 365 has some decent recovery options, there are many valid reasons to back up Microsoft 365 mailboxes. Independent, local backup lets you:

  • effectively protect against accidental data loss,
  • mitigate the risk of intentional data deletion,
  • retain full access to your data,
  • comply with legal requirements.

CodeTwo Backup for Office 365 is a solution which lets you back up and restore Microsoft 365 data, including mailboxes, public folders, SharePoint Online, OneDrive for Business and Microsoft Teams data. Besides the general advantages mentioned above, the tool lets you benefit from:

  • indefinite backup and archiving of Microsoft 365 data,
  • support for mailboxes in any Exchange Online Plan,
  • full accessibility of your cloud data,
  • ability to restore items to their original location, or to another folder, mailbox, and even to a different tenant,
  • easy browsing through versions & searching for items.

Download a free trial

CodeTwo Products

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

*

*