Understanding Email Deletion in Exchange Online

When users delete emails, they go to Deleted Items, then Recoverable Items, and finally are purged after 30 days (default retention).

Method 1: User Self-Recovery (Deleted Items)

Users can recover from Deleted Items themselves:

  1. Open Outlook
  2. Go to Deleted Items folder
  3. Right-click email ? Move ? Inbox

Method 2: Recover from Recoverable Items

If deleted from Deleted Items:

  1. In Outlook, go to Deleted Items folder
  2. Click "Recover items deleted from this folder" (top menu)
  3. Select emails ? Restore

Method 3: Admin Recovery Using PowerShell

Connect to Exchange Online and search for deleted items:

Connect-ExchangeOnline

Search-Mailbox -Identity "user@domain.com" -SearchDumpsterOnly -SearchQuery "subject:'Important Email'" -TargetMailbox "admin@domain.com" -TargetFolder "RecoveredEmails"

Method 4: eDiscovery Search (Best for Large Recoveries)

  1. Go to Microsoft 365 Compliance Center
  2. eDiscovery ? Create new case
  3. Add search ? Select mailbox
  4. Define search criteria
  5. Export results and restore to mailbox

Increase Retention Period

Extend deleted item retention from 30 to 60 days:

Set-Mailbox -Identity "user@domain.com" -RetainDeletedItemsFor 60

Prevention Tips

  • Enable litigation hold for critical mailboxes
  • Train users on proper archiving
  • Implement retention policies
  • Regular backups with third-party tools