Email Recovery

How to Find Who Deleted Emails from a Shared Mailbox in Microsoft 365

WPS Editor Oct 10, 2026 869 views

Question details

The user needs to identify which individual or automated rule deleted messages from an Office 365 shared mailbox using updated administrative portals.

How to Find Who Deleted Emails from a Shared Mailbox

Product: Microsoft Exchange Online
Device & OS: not provided
Scenario: Emails are unexpectedly missing from a shared mailbox, prompting an administrator to investigate the deletion source.
Observed behavior: Missing messages require administrators to track manual deletions via audit logs and rule-based automated deletions via mailbox settings.

Before you start

Ensure you have the necessary administrator permissions, such as the View-Only Audit Logs or Audit Logs role in Microsoft Purview, and verify that auditing is enabled for your organization.

Solution 1Recommended

Search Audit Logs in Microsoft Purview

Use the Microsoft Purview portal to track manual email deletion events, identifying the specific user and time of the action.

The legacy Office 365 Security and Compliance Center has been retired. Administrators must now use the Microsoft Purview compliance portal to search audit logs for mailbox activities.

Access Microsoft Purview

Open the Audit Tool

Navigate to the left-hand menu and select 'Audit' to open the audit log search page.

Set Search Criteria

Specify the date and time range for when the emails went missing. In the 'Activities' dropdown, select Exchange mailbox activities such as 'Soft deleted messages' or 'Hard deleted messages'.

Filter by Shared Mailbox

In the 'File, folder, or site' field, or by filtering the results later, enter the email address of the affected shared mailbox and click 'Search'.

Review the Results

Once the search completes, click on the relevant deletion events to view the details, which will reveal the User ID (email address) of the person who deleted the messages.

Audit Log Delay: It can take up to 30 minutes or more for an audit log event to appear in the Purview portal after the deletion occurs.

Solution 2

Inspect Mailbox Rules in Exchange Admin Center

Check if an automated inbox, sweep, or forwarding rule is responsible for moving or deleting the shared emails.

Free Microsoft Office alternative

Try WPS Office for a Seamless and Free Productivity Experience

While Microsoft 365 handles your enterprise email servers, WPS Office is an excellent, lightweight alternative for managing your Word documents, Excel spreadsheets, and PowerPoint presentations. Enjoy a familiar layout and full format compatibility without the heavy subscription fees.

1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
2. Install the Software: Run the installer file and follow the simple on-screen instructions to set up the software.
3. Open Your Office Files: Launch WPS Office and instantly open, edit, and save your existing Word, Excel, and PowerPoint documents without losing formatting.

Fully compatible with Microsoft Office formats (DOCX, XLSX, PPTX)Lightweight installation with fast loading times and low system resource usageAll-in-one desktop app for PDF, Word, Excel, and Presentation tasksFree to use with a familiar, user-friendly interface requiring no learning curve

Frequently Asked Questions

Why can't I find the Office 365 Security and Compliance Center?

Microsoft has retired the legacy Security and Compliance Center. The features for searching audit logs have been moved to the Microsoft Purview compliance portal, while mailbox rule management is handled in the Exchange admin center.

How long are audit logs kept for a shared mailbox?

By default, standard audit logs in Microsoft 365 are retained for 90 days. Depending on your organization's subscription and whether Audit (Premium) is assigned, logs can be retained for up to 1 year or longer.

Do I need special permissions to search for deleted emails in Purview?

Yes. To run an audit log search in Microsoft Purview, your account must be assigned the View-Only Audit Logs or Audit Logs role in the Exchange admin center.

Can I recover the emails once I find out who deleted them?

Yes, if the emails were soft-deleted, you can usually recover them from the Recoverable Items folder within 14 to 30 days, depending on your organization's deleted item retention policy settings.

Migration & Recovery