How to recover user emails in Microsoft 365

[Update]: This article was updated on July 26, 2021.

If you are a Microsoft 365 administrator, it’s only a matter of time before you are tasked with restoring deleted emails (or other mailbox items). While you can use eDiscovery to recover deleted items, there is an easier way which lets you restore deleted items straight back to where they originated from. Below, I’ll describe how to recover deleted Microsoft 365 users’ mailbox items with PowerShell and with the Exchange admin center (EAC). And for the dessert, I’ll show you how to recover public folders deleted from the organization.

But first, it is crucial to understand what happens to deleted emails in Microsoft 365.

What happens to deleted items in Microsoft 365

There are 3 levels of “deletion” from which items can be restored:

First, if an item is removed using the delete key (or right-click > delete), it goes to the Deleted Items folder. In other words, it is the standard mailbox’s trash bin. Users can easily access and recover such item using their Outlook desktop app or in Outlook on the web.

Next, if an item is deleted from the Deleted Items folder, it enters a soft-delete state, i.e. it goes to the Recoverable Items folder. That’s also where an email goes after a user deletes it with the shift+delete key combination. While the user can still restore an email from there, it will be permanently removed when the retention period is over. By default, the period is 14 days long, but this can be extended to a maximum of 30 days.

Finally, if a user purges an email from the Recoverable Items folder, it enters the hard-delete state. In Exchange Online, the item is placed in a hidden Purges folder which is the Recoverable Items subfolder which cannot be accessed by users (items from this folder can only be accessed and restored by a Microsoft 365 admin).

Exchange Online uses Managed Folder Assistant to automatically delete items from the Purges folder. You can also use Search-Mailbox with the -DeleteContent switch to permanently delete items. Both methods cause emails to be removed beyond recovery. When this happens, the only way to recover deleted items is to restore them from a backup.

If a mailbox is on litigation hold, emails and other items won’t be permanently deleted from the Recoverable Items folders. Provided you have the right license for the user, you can recover the deleted items.

Read more about Microsoft 365 litigation holds and retention policies

How to recover deleted Microsoft 365 items using PowerShell

Before you start the recovery process, make sure you have the Mailbox Import Export role assigned in Exchange Online and connect to Exchange Online via PowerShell.

To restore deleted items to their original mailboxes, use the following two cmdlets: Get-RecoverableItems to find the right items and Restore-RecoverableItems to put them back in their original folders (or in the inbox if these folders are no longer accessible).

Take a look at the most common applications of the Get-RecoverableItems cmdlet in the examples below:

To search for all deleted items from a user’s mailbox, use:

Get-RecoverableItems -Identity meganb | select identity, subject, lastmodifiedtime, itemclass

To find emails deleted in the last two days only:

Get-RecoverableItems meganb -FilterStartTime (get-date).adddays(-2) -FilterItemType IPM.Note | select Identity,Subject,LastmodifiedTime

You can easily search through all mailboxes for particular messages. In that case, it’s best to use a detailed search query. This way, the cmdlet will not produce an overwhelming number of results:

$mailboxes=(get-mailbox)
foreach ($mailbox in $mailboxes) {Get-RecoverableItems $mailbox -SubjectContains "audit" -FilterStartTime (get-date).adddays(-2) -FilterItemType IPM.Note | select Identity,Subject,LastmodifiedTime}

The easiest way to recover this data is to add Restore-RecoverableItems in a pipeline, following the query which finds the items to be restored:

Get-RecoverableItems -Identity lynner -SubjectContains "audit" | Restore-RecoverableItems

You can also use the Restore-RecoverableItems cmdlet independently. For example, to restore all items deleted by specific users, run:

Restore-RecoverableItems -Identity “user1”, “user2”

The Restore-RecoverableItems cmdlet accepts more than one value of the Identity parameter (separated with commas) and has similar filters as the Get-RecoverableItems cmdlet.

Recover deleted items in the Exchange admin center

The Exchange admin center in Microsoft 365 includes an option to restore deleted items using the UI instead of PowerShell.

To recover deleted items, go to the Exchange admin center > Recipients > Mailboxes, choose the user whose mailbox items you want to restore, in the pane that opens, go to the Others tab, and click Recover deleted items:

Use the filters in the next window to search for certain subject lines, choose which item type to look for and which folder to search through. When you are done specifying your search criteria, highlight the items to be restored and click the Recover deleted items button.

Currently, there is no option to search for messages in multiple mailboxes at the same time.

And that’s it. Simple as that (or complex as that if you prefer), this is how you recover deleted items.

Restore deleted public folders

Public folders are a peculiar Exchange Online feature. While some companies can go without even knowing that public folders exist, other rely heavily on them and their collaborative capabilities. A public folder can contain emails, posts and documents. Now, with the right permissions, it is quite easy to delete a public folder. The surprising part is that there’s no way to restore it using EAC – you need to resort to PowerShell. That’s how you do it:

1. First, connect to Exchange-Online (here’s a guide on how to do that) and run the following cmdlet to find out if there are any recently deleted public folders:

Get-PublicFolder \NON_IPM_SUBTREE\DUMPSTER_ROOT -Recurse |?{$_.FolderClass -ne "$null"}

• If the deleted public folder has an active eDiscovery (litigation) hold, you need to navigate to another dumpster directory. Additionally, instead of searching for all public folders, you can filter results by the deleted folder’s name:

Get-PublicFolder \NON_IPM_SUBTREE\DISCOVERYHOLDS -Recurse |?{$_.Name -like "IT"}

• To restore all deleted public folders returned by any of the cmdlets above, pipeline its results to:

… | Set-PublicFolder -Path \

Where -Path specifies the parent folder to which deleted public folders will be restored (use -Path \ to restore them to the root of the public folder tree).

To restore a specific deleted public folder, you need to specify its exact identity, for example:

Set-PublicFolder -Identity \NON_IPM_SUBTREE\DUMPSTER_ROOT\DUMPSTER_EXTEND\RESERVED_1\RESERVED_1\6d9f59c5-fb2b-46e5-b658-961e9fd336f1 -Path \

Things to keep in mind:

• To use the cmdlets, you need to be assigned to the Public Folders role. By default, it is included in the Organization Management role group.
• If you have a long list of deleted public folders, you can use

  Get-PublicFolder \NON_IPM_SUBTREE\DUMPSTER_OOT -recurse | Get-PublicFolderStatistics

  to see, for example, item count in the public folder, or its last modification time.
• Restoring a public folder works recursively – all subfolders and items are restored as well.
• By default, the retention period for deleted public folders is 90 days. After that, all data is purged beyond restoring, unless you backed up this data.

But what to do if the native methods are insufficient?

Back up and restore Microsoft 365 data

The most reliable way to protect your data against being deleted accidentally or on purpose is to use a Microsoft 365 backup tool. Although Microsoft 365 has some decent recovery options, there are many valid reasons to back up Microsoft 365 mailboxes. Independent, local backup lets you:

• effectively protect against accidental data loss,
• mitigate the risk of intentional data deletion,
• retain full access to your data,
• comply with legal requirements.

CodeTwo Backup for Office 365 is a solution which lets you back up and restore Microsoft 365 data, including mailboxes, public folders, SharePoint Online, OneDrive for Business and Microsoft Teams data. Besides the general advantages mentioned above, the tool lets you benefit from:

• indefinite backup and archiving of Microsoft 365 data,
• support for mailboxes in any Exchange Online Plan,
• full accessibility of your cloud data,
• ability to restore items to their original location, or to another folder, mailbox, and even to a different tenant,
• easy browsing through versions & searching for items.

Download a free trial