Gone isn't immediately gone in Microsoft 365
When an employee deletes an email, it first goes to the Deleted Items folder. It stays there until someone empties the folder or a policy cleans it up. If the folder is emptied, or someone deletes an email straight away with Shift+Delete, the message disappears from view. But it then goes to a hidden folder: Recoverable Items.
In Exchange Online, email stays in that folder for 14 days by default. An admin can extend that per mailbox to a maximum of 30 days. Only after that is the email permanently deleted, unless a retention policy applies to the mailbox.
Recovering it yourself in Outlook
An employee can solve a lot themselves, without waiting for the IT partner:
- Is the email still in Deleted Items? Open the folder, find the message and move it back to the Inbox or another folder.
- Is the folder already empty? Go to the Deleted Items folder and choose Recover deleted items. In Outlook on the web and the new Outlook, that option is at the top of the folder or in the menu when you right-click the folder. You then see the email still in Recoverable Items and can restore it.
- Search in a targeted way. Use the search box in that view to look for a sender or subject. That saves a lot of scrolling.
Restored email returns to the mailbox, usually to the Deleted Items folder. Move it to a permanent folder afterwards, so it doesn't disappear again in the next clean-up.
When an admin has to do it
Sometimes the employee can't do it themselves. For example because they have left, because it involves many messages, or because nobody remembers exactly when the email was deleted. An admin can recover deleted items from a mailbox in the Exchange admin center, on the user's mailbox, or with PowerShell. They can filter by period, subject or item type and restore the messages in one go. The employee's password isn't needed for that.
If it concerns an employee who has left, it's wise to convert the mailbox to a shared mailbox instead of deleting the account. A deleted account is permanently gone after 30 days, including the email. Include this in your joiner and leaver checklist.
Missing email can also be a sign of misuse
Is email disappearing without anyone deleting it? Then look further. Attackers who have taken over an account often create rules that automatically delete or move email, so the victim doesn't notice anything. Read how to spot suspicious mailbox rules. The audit log shows who deleted what and when.
Need to go back further? Arrange it in advance
Thirty days is enough for most mistakes. But sometimes it only turns out months later that an email is needed, for example in a dispute with a customer or a question from the accountant. Then the default setting no longer helps. Two things do:
- Retention policies. With retention policies in Microsoft 365 you specify that email is kept for a certain period, even if an employee deletes it.
- A backup. Microsoft 365 isn't a backup in the traditional sense. Read why the cloud is not a backup. A separate mailbox backup gives you a copy that is independent of your own environment.
How Floor ICT handles it
Floor ICT sets the retention period for deleted items on all mailboxes to the maximum of 30 days, so you have more time to fix a mistake. We agree with you how long email should be kept beyond that and arrange it with retention policies or a backup. If an email is missing, we recover it for you, without signing in as the employee. And if email disappears for no clear reason, we immediately check the mailbox rules and sign-ins. That way a wrong click is no longer a disaster.