You can recover deleted items from mailboxes in the Exchange admin center and with PowerShell. This can be different sorts of items such as notes, tasks, messages, or calendar items in the Deleted Items folder and the Recover Deleted Items. When recovering the items, it will restore them back to the original folder. In this article, you will learn how to recover deleted items from a Microsoft 365 mailbox.
Table of contents
Required permissions
Before you start, you must assign the required permissions to recover deleted items in the Exchange admin center.
Without the permissions, you can’t use the feature in the Exchange admin center and you will get the below error if you run the commands in Exchange Online PowerShell.
Get-RecoverableItems: The term ‘Get-RecoverableItems’ is not recognized as a name of a cmdlet, function, script file, or executable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
We recommend following the steps in How to fix recover deleted items greyed out in Exchange Online.
- You need to assign the admin as a member of the Discovery Management role group
- Add the Mailbox Import Export role to the Discovery Management role group
Note: Wait at least one hour for the permissions to take effect.
Recover deleted items in Exchange admin center
After you assign the required permission you can recover deleted items for a Microsoft 365 mailbox.
Note: The items in the Deleted Items folder can stay there for as long as you want. But when you delete an item from the Deleted Items folder, it will move to the Recover Deleted Items. These deleted items will stay in the recycle bin for 14 days by default, and you can set the Exchange Online deleted items retention period up to a maximum of 30 days.
Recover deleted items
To recover deleted items in EAC, follow these steps:
- Sign in to Exchange admin center
- Click Recipients > Mailboxes
- Click on a mailbox from the list
- Click the tab Others
- Click Recover deleted items
The list shows all the deleted items and the folder type where to find them, such as Recoverable Items or Deleted Items. It also shows the original folder where each mail item was placed, such as Inbox, Sent Items, or Calendar.
- Select the items you want to recover
- Click Recover deleted items
- It successfully recovers each item to the original folder
Verify recover deleted items
To verify you recovered the deleted items to the original folder in Outlook, follow these steps:
- Sign in to Outlook
- Click the folder
- Verify the mail item is back to the original folder (Junk Email)
- Verify the other mail item is back to the original folder (Sent Items)
- Verify the last mail item is back to the original folder (Inbox)
- Verify the items don’t appear in the Deleted Items folder or Recover Deleted Items
Recover deleted items with PowerShell
To recover deleted items with PowerShell, go through the below steps.
Note: The items in the Deleted Items folder can stay there for as long as you want. But when you delete an item from the Deleted Items folder, it will move to the Recover Deleted Items. These deleted items will stay in the recycle bin for 14 days by default, and you can set the Exchange Online deleted items retention period up to a maximum of 30 days.
Connect to Exchange Online PowerShell
To run the PowerShell commands specified in the current article, you must Connect to Exchange Online PowerShell.
Connect-ExchangeOnlineRestore specific deleted items
To find deleted items in mailboxes, we will use the Get-RecoverableItems PowerShell cmdlet. This cmdlet will get all the items in the Deleted Items folder and Recover Deleted Items.
Run the below PowerShell command with the below parameters to find a specific item to recover.
Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com" -SubjectContains "Healthcare"The PowerShell output shows the below result.
LastParentPath : Junk Email
LastParentFolderID : DC498BC89A10B34E8A7B9BC03E1040F8000000000114
OriginalFolderExists : True
Identity : Stephen.Hunter@m365info.com
MailboxIdentity : a2ff010e-0e03-4c56-8863-2ae7f07876dd\e7a17671-2398-474a-bca5-5330e8602e89
ItemClass : IPM.Note
Subject : Re: Healthcare Professional Email list
PolicyTag : 3dbb5f39-dc76-4916-9db3-fa9191760a55
EntryID : 000000005A01B97AEDFF8D44BCBCAFF9CB9F8EA50700DC498BC89A10B34E8A7B9BC03E1040F800001AE485C00000
DC498BC89A10B34E8A7B9BC03E1040F800007D4A02AB0000
SourceFolder : Recoverable Items\Deletions
LastModifiedTime : 04/04/2024 23:22:18
IsValid : True
ObjectState : NewWe will use the Restore-RecoverableItems Powershell cmdlet to restore specific deleted items in mailboxes.
Restore-RecoverableItems -Identity "Stephen.Hunter@m365info.com" -SubjectContains "Healthcare"The PowerShell output shows it restored the item to the Junk Email folder, where it was originally located.
RestoredToFolderPath : Junk Email
RestoreToFolderId : LgAAAABaAbl67f+NRLy8r/nLn46lAQDcSYvImhCzTop7m8A+EED4AAAAAAEUAAAB
WasRestoredToOriginalFolder : True
WasRestoredSuccessfully : True
Identity : Stephen.Hunter@m365info.com
MailboxIdentity : a2ff010e-0e03-4c56-8863-2ae7f07876dd\e7a17671-2398-474a-bca5-5330e8602e89
ItemClass : IPM.Note
Subject : Re: Healthcare Professional Email list
PolicyTag : 3dbb5f39-dc76-4916-9db3-fa9191760a55
EntryID : 000000005A01B97AEDFF8D44BCBCAFF9CB9F8EA50700DC498BC89A10B34E8A7B9BC03E1040F800001AE485C00000DC498BC89A10B34E8A7B9BC03E1040F800007D4A02AB0000Restore all deleted items for a single mailbox
To restore all the items in the Deleted Items folder and Recover Deleted Items, follow the below steps.
Run the PowerShell command to get a list of all the deleted items of a single mailbox.
Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com" | Select-Object Subject, ItemClass, SourceFolder, LastParentPath The PowerShell output shows the below result.
Subject ItemClass SourceFolder LastParentPath
------- --------- ------------ --------------
Re: Healthcare Professional Email list IPM.Note Recoverable Items\Deletions Junk Email
Canceled: Meeting customer IPM.Schedule.Meeting.Canceled Recoverable Items\Deletions Inbox
Canceled: Meeting with customer IPM.Schedule.Meeting.Canceled Recoverable Items\Deletions Inbox
FW: Weekly meeting Sales IPM.Note Recoverable Items\Deletions Inbox
Re: Follow Up IPM.Note Recoverable Items\Deletions Junk Email
IPM.Note Recoverable Items\Deletions Junk Email
FW: Meeting PM.Note Recoverable Items\Deletions Inbox
Meeting IPM.Note Recoverable Items\Deletions Inbox
RE: REMINDER IPM.Note Recoverable Items\Deletions Junk Email
spam IPM.Note Deleted Items Inbox
Your digest email IPM.Note Deleted Items Inbox
FW: Subject1 IPM.Note Deleted Items InboxRestore all the recoverable items of a single mailbox.
Get-RecoverableItems -Identity "Stephen.Hunter@m365info.com" | Restore-RecoverableItemsThat’s it!
Read more: How to Restore a deleted Microsoft 365 mailbox »
Conclusion
You learned how to recover deleted items from Microsoft 365 mailbox. First, you need to assign the required permissions to search and recover deleted items for mailboxes. Then you can choose to restore the deleted items in Exchange admin center or with PowerShell.
Did you enjoy this article? You may also like Manage mailbox folder permission with PowerShell. Don’t forget to follow us and share this article.