'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Recover Soft-Deleted Email Messages in Exchange Online
Question details
The user needs to recover a soft-deleted email message, such as a phishing email, in Exchange Online for further security investigation.
- Product
- Exchange Online
- Device & OS
- not provided
- Scenario
- Investigating a soft-deleted email message that requires retrieval from Exchange.
- Observed behavior
- The email has been soft-deleted and must be located and restored from the Recoverable Items folder, Junk Email, or via Exchange admin recovery tools.
Verify the mailbox's recoverable-items retention period, as messages permanently purge after this timeframe expires. Ensure you have the necessary Exchange administrator or eDiscovery permissions to access advanced recovery tools.
Recover via Microsoft Defender Explorer
Best for administrators needing to locate and release specific security-flagged messages like quarantined or soft-deleted phishing emails.
Microsoft Defender Explorer allows administrators to track down specific emails that might have bypassed standard recovery cmdlets due to security policies.
Navigate to the Microsoft 365 Defender portal and log in using your global or Exchange administrator credentials.
Go to the Email & collaboration section in the left-hand navigation pane and select Explorer.
Run a detailed query using the sender address, recipient, or specific message ID to find the soft-deleted phishing message.
Select the message from the search results and choose the option to release or restore a copy to the user's Junk Email or Inbox for investigation.
Restore from the Recoverable Items Folder
Ideal for users or admins attempting to recover recently deleted items that have bypassed the standard Deleted Items folder.
Manage Your Documents Efficiently with WPS Office
While Exchange Online handles your email infrastructure, WPS Office provides a free, lightweight, and fully compatible alternative for your daily document management needs. Seamlessly open, edit, and save Word, Excel, and PowerPoint files without expensive subscription costs.
- 1. Download WPS Office: Visit the official WPS website and click the free download button for your operating system.
- 2. Install the suite: Run the downloaded installer and follow the quick on-screen instructions to set up the software.
- 3. Open and edit files: Launch WPS Office to immediately start creating new documents or opening your existing Microsoft Office files.
Frequently Asked Questions
Can I use Undo-SoftDeletedMailbox to recover a single email?
No, the Undo-SoftDeletedMailbox cmdlet is used specifically for restoring an entire soft-deleted mailbox. For individual messages, you should use the Recoverable Items folder or Exchange Online recovery tools like Defender Explorer.
How long are soft-deleted emails kept in Exchange Online?
The retention period depends on the mailbox settings configured by your administrator. By default, deleted items are kept in the Recoverable Items folder for 14 days, but this can be extended up to 30 days.
What if the email is no longer in the Recoverable Items folder?
If the retention period has expired and the email has been purged from Recoverable Items, you will need to contact your Exchange administrator. They may be able to recover it if an eDiscovery hold or a specific backup policy is currently in place.
Does the Restore-RecoverableItems cmdlet always work for phishing emails?
Not always. Depending on the folder structure and how the message was quarantined or deleted by security filters, administrators may find more success releasing a copy of the message directly through Microsoft Defender Explorer.
