Recover deleted messages in a user's mailbox in Exchange Online
Article
Administrators can search for and recover deleted email messages in a user's mailbox. This includes items that are permanently deleted (purged) by a person (by using the Recover Deleted Items feature in Outlook or Outlook on the web (formerly known as Outlook Web App)), or items deleted by an automated process, such as the retention policy assigned to user mailboxes. In these situations, the purged items can't be recovered by a user. But administrators can recover purged messages if the deleted item retention period for the item hasn't expired.
Note
In addition to using this procedure to search for and recover deleted items (which are moved to the Recoverable Items\Purges folder if either single item recovery or litigation hold is enabled), you can also use this procedure to search for items residing in other folders in the mailbox and to delete items from the source mailbox.
What you need to know before you begin?
Estimated time to complete: 15-30 minutes.
Procedures in this article require specific permissions. See each procedure for its permissions information.
Single item recovery must be enabled for a mailbox before the item you want to recover is deleted. In Exchange Online, single item recovery is enabled by default when a new mailbox is created. In Exchange Server, single item recovery is disabled when a mailbox is created. For more information, see Enable or disable single item recovery for a mailbox.
To search for and recover items, you must have the following information:
Source mailbox: This is the mailbox being searched.
Search criteria: Criteria include sender or recipient, or keywords (words or phrases) in the message.
You need the Mailbox Import Export RBAC role before you can do this procedure or procedures.
Use EAC for recovering deleted messages
In the EAC, navigate to Recipients > Mailboxes.
Select the mailbox for which you want to recover deleted messages.
Under Others > Recover deleted items, select the link Recover deleted items.
Use the filters available to locate the messages you want to recover, and then select Apply filter.
Select the messages you want to recover, and then click Recover deleted items.
This example returns all of the available recoverable deleted messages with the specified subject in the mailbox laura@contoso.com for the specified date/time range.
Once you have finalized the filters for the messages you want to recover, you can restore them to the user's mailbox by using the Restore-RecoverableItems cmdlet.
After using the Get-RecoverableItems cmdlet to verify the existence of the item, this example restores the specified deleted items in the specified mailboxes:
Users can recover a deleted item if it hasn't been purged and if the deleted item retention period for that item hasn't expired. If users need to recover deleted items from the Recoverable Items folder, point them to the following articles:
This module examines how Microsoft 365 supports data governance by enabling organizations to archive content by using archive mailboxes and restore deleted data in Exchange Online and SharePoint Online.