Recover Deleted Email in Exchange Online: Recoverable Items, Purview Holds, eDiscovery, and Inactive Mailboxes

When someone says "recover the deleted email," the answer depends on which layer still holds it. Admins who only know the Deleted Items folder and the 14 day window run out of options quickly. Admins who understand the hold and retention model can often recover mail that users and attackers believed was gone. This guide is organized around that model.

How Deleted Mail Actually Moves

Exchange stores a hidden structure called Recoverable Items in every mailbox. Following one deleted message shows the layers:

1. Deleted Items folder. The user presses Delete. The item moves here. It stays until the user empties it, or a retention tag on the folder deletes it.
2. Recoverable Items, Deletions subfolder (the "dumpster"). The user empties Deleted Items, or presses Shift+Delete. The item moves here and is hidden from normal view. Users can restore it with *Recover deleted items*. It stays for the deleted item retention period: 14 days by default, 30 days at most.
3. Recoverable Items, Purges subfolder. When the retention period ends, or when a user purges items from the recovery view, the item moves to Purges. Users cannot see it. If no hold applies, a background process (the Managed Folder Assistant) removes it permanently. If a hold applies, it stays.
4. Other hidden Recoverable Items subfolders that matter for recovery:

- Versions: previous copies of items that were edited, kept when a hold is on (copy-on-write). - DiscoveryHolds: items preserved by eDiscovery or litigation hold. - SubstrateHolds (the Preservation Hold Library for Teams chats and other content): items preserved by Microsoft Purview retention policies. - Audits: mailbox audit records. - Calendar Logging: older versions of calendar items, which help rebuild a changed or deleted meeting.

The consequence is simple. Whether an item can be recovered after 14 or 30 days depends entirely on whether a hold or retention policy was in place while it was still in the mailbox.

Recoverable Items Limits and Quotas

• The Recoverable Items folder has its own quota, separate from the mailbox. Microsoft's documentation lists a default quota of 100 GB, raised to 110 GB when a hold is applied, with warning thresholds before the limit. Check the current numbers in Microsoft's documentation.
• When a mailbox is on hold and Recoverable Items fills, the mailbox cannot keep preserving items. Use a mailbox archive with auto-expanding storage so held items can move there, and monitor the folder's size.
• Check usage:

Level 1: What Users Can Recover

1. Search Deleted Items first.
2. In Outlook on the web: select Deleted Items, then Recover items recently removed from this folder. In Outlook for Windows: Folder, Recover Deleted Items (or Home, Recover Deleted Items From Server).
3. Select the items and choose Restore.

This works only for items in the Deletions subfolder, inside the retention window. For anything older, the user needs an administrator.

Level 2: Extend the Window to 30 Days

New mailboxes default to 14 days, so repeat this for new users or add it to the onboarding script. This is the simplest improvement, costs nothing, and covers many accidents. It does not cover an attacker or user who has time to purge. Treat it as the floor.

Level 3: Admin Recovery With PowerShell

Admins can search and restore items from Recoverable Items without the user:

These cmdlets need an appropriate role, and parameters have changed over time, so check Get-Help Restore-RecoverableItems -Full in your tenant. They recover only what is still in the Recoverable Items folder's Deletions area. Items already moved to Purges and not held are beyond reach.

Level 4: Holds Keep Deleted Items Past the Window

A hold tells Exchange: never purge items from this mailbox, even if the user deletes them, until the hold is removed. Items remain in Recoverable Items (Deletions, Purges, DiscoveryHolds), and edited items are versioned. There are several ways to apply holds:

Method	Where	Scope	Typical use
Litigation hold	Exchange admin center or PowerShell	A single mailbox	Quick protection of a person's mailbox
eDiscovery hold	Microsoft Purview, eDiscovery case	Mailboxes and Teams chosen in the case	Legal matters, with case management and search
Retention policy	Microsoft Purview, Data lifecycle management	Many mailboxes, by group or all	Routine policy, such as "keep email 7 years"
Retention label	Microsoft Purview, applied by users or auto-labeling	Individual items or folders	Records, contracts, and special material
In-Place Hold (legacy)	Retired	Query-based holds	Existing holds may still exist, but plan to move them

Litigation hold

A mailbox needs a license that includes the feature (generally Exchange Online Plan 2 or an equivalent such as Microsoft 365 E3 or E5). Hold applies from the moment it is set. It does not recover items already purged.

Retention policies in Microsoft Purview

A retention policy applies a rule to many mailboxes at once. Build one in the Microsoft Purview portal: Solutions, Data Lifecycle Management, Policies, Retention policies, New retention policy.

1. Give it a clear name and description tied to the reason (for example, "Email 7 years, finance").
2. Choose the scope: all Exchange mailboxes, or selected groups and users.
3. Choose the action: retain items for a period, delete items after a period, or retain and then delete.
4. Choose when the clock starts: when the item was created or last modified.
5. Review and create.

The Managed Folder Assistant applies the policy, and it can take up to seven days to reach every mailbox. When a user deletes a retained item, Exchange keeps a copy in the Recoverable Items hidden folders (SubstrateHolds) for the retention period. Users do not see it, but compliance tools can find it.

Adaptive scopes let a policy follow attributes, such as department or location, instead of a fixed list. Use them when membership changes often.

Retention labels are different from policies. A label is applied to an item or a folder (by a user, by a rule, or by auto-labeling based on content), and can declare an item a *record* so it cannot be edited or deleted. Use labels for contracts, HR files, and regulated records. Use policies for a broad "keep everything for N years" baseline.

Rules for combining policies

Several policies can apply to one mailbox. The principles Microsoft documents are that retention wins over deletion, and that the longest retention period wins. A delete-after-3-years policy does not delete an item that another policy or hold keeps for 7. Always check for conflicts before relying on a delete rule.

Level 5: The Preservation Hold Library and Hidden Folders

When a retention policy or hold preserves an item that a user edited or deleted, Exchange keeps the earlier copy in hidden folders in Recoverable Items. You cannot see them in Outlook, but you can:

• Search them with Content Search or an eDiscovery case. Searches include Recoverable Items by default, so a search finds items users deleted.
• Check what exists: Get-MailboxFolderStatistics -FolderScope RecoverableItems lists the subfolders and their sizes.
• Export the results from Purview as a PST or as individual messages, and give the user the recovered items.

For SharePoint and OneDrive, the equivalent is the Preservation Hold Library, a hidden document library in each site where Microsoft keeps the previous version of files that retention preserved.

Level 6: Content Search and eDiscovery to Find and Export Mail

Content Search is a general tool for finding mail in mailboxes, including Recoverable Items.

1. In the Microsoft Purview portal, open eDiscovery, Content search (or an eDiscovery case for formal matters).
2. Create a search. Select the mailboxes (specific users, or all).
3. Add conditions: keywords, sender, recipients, date range, subject, message type.
4. Run the search and review the statistics and a preview.
5. Export the results to a PST or as individual messages, or Restore them into a mailbox with the export tool or New-ComplianceSearchAction.

Permissions matter. You need the eDiscovery Manager role (or similar) in Purview, and sensitive searches are audited. eDiscovery Premium adds custodians, review sets, and legal hold workflows.

Content Search also has a dangerous sibling, *purge*, which can permanently delete matching mail from many mailboxes. Admins use it to remove a phishing message that reached 400 inboxes. Treat it with extreme care: preview first, run it on a small set first, and keep an approval record. Soft delete moves items to Recoverable Items. Hard delete removes them.

Find Out Who Deleted What

When mail is missing, work out whether it was a user, a rule, an app, or an attacker. Mailbox auditing is on by default for most mailboxes. Search for deletion events:

Audit retention depends on your license, so check how long records are kept. Combine this with the rule audit in our inbox rules guide, because mass deletion is often caused by a rule.

Recovering Calendar Items, Contacts, and Tasks

Recoverable Items contains calendar, contacts, and tasks as well as mail. Calendar items are kept longer (120 days by default under the calendar logging behavior), which helps when a meeting series was deleted. Use Calendar Logging records to see how a meeting changed:

Admins use this to answer "who cancelled the meeting?" and to rebuild its original details.

Recovering a Deleted Mailbox or User

Situation	What to do
User account deleted within 30 days	Restore the user in the Microsoft 365 admin center, Users, Deleted users. The mailbox returns with it
Mailbox disconnected or soft-deleted	Get-Mailbox -SoftDeletedMailbox shows it. Restore with Undo-SoftDeletedMailbox or recover it into another mailbox with a restore request
User deleted more than 30 days ago, but the mailbox was on hold	The mailbox became an inactive mailbox. Find it with Get-Mailbox -InactiveMailboxOnly and restore or search it
User deleted more than 30 days ago, no hold	Gone. Only a backup can help

Inactive mailboxes are a major Purview idea. If a mailbox has a hold or retention policy applied, deleting the user does not delete the mailbox; it becomes inactive and is kept for the hold duration, with no license cost. This is how organizations keep a leaver's mail for years without paying monthly for the person. The hold must exist *before* the account is deleted. Details and the licensing cautions are in the shared mailbox guide, which covers the leaver pattern.

To restore the contents of an inactive mailbox, create a new target mailbox and use a mailbox restore request or recover it from the Purview portal, using the roles Microsoft documents. Test that on a lab account before you need it.

The Same Ideas Outside Exchange

Users also call OneDrive and SharePoint files "the recycle bin" and the same layered model applies there:

• Deleted files go to the first-stage recycle bin (users can restore them).
• Then to the second-stage recycle bin (site collection admins can restore them). The combined retention is 93 days by default.
• Retention policies and holds keep items longer, in the Preservation Hold Library.

Teams chats and channel messages live in hidden mailbox folders, and retention policies for Teams preserve them there. Teams deletions can be recovered through eDiscovery for the retention period.

When You Need a Real Backup

Holds and retention policies are about preservation and compliance, not restoration of a point in time. They do not let you say "put this mailbox back as it was last Tuesday." They are also affected by a mistake in the policy itself, or by an admin with enough rights removing the hold. If you need protection against ransomware, a malicious admin, or a large accidental deletion across many users, you need a backup that sits outside the tenant's normal controls.

• Third-party Microsoft 365 backup services copy mailboxes, OneDrive, SharePoint, and Teams data to storage you control, with point-in-time restore.
• Microsoft 365 Backup is a Microsoft service for restoring mailboxes, OneDrive, and SharePoint to a point in time. Check its current availability, pricing, and scope on Microsoft's site before you rely on it.
• Test restores on a schedule. A backup that has never been restored is an assumption.

Decide what you need to recover (item, mailbox, entire tenant), how quickly, and how far back. Retention and holds answer "can we prove or find the data." Backup answers "can we put it back."

A Practical Recovery Design

For a typical small and mid-sized organization:

1. Set deleted item retention to 30 days for all mailboxes.
2. Apply a Purview retention policy that keeps email for a period that matches your obligations (often 3, 5, or 7 years), starting with *retain only*, and add *delete* later after review.
3. Put litigation hold or an eDiscovery hold on mailboxes of people involved in a dispute, executives, and finance.
4. Make sure auto-expanding archives are on for mailboxes that hold large amounts.
5. Use the inactive mailbox approach for leavers whose mail must be retained.
6. Add a third-party backup for tenant-wide protection.
7. Keep mailbox auditing on and know how long audit records are kept.
8. Write a runbook for restoring a mailbox, an item, and a deleted user, and rehearse it every year.

How to Check It Worked

• Delete a test message, empty Deleted Items, and confirm it appears in *Recover deleted items*.
• Confirm RetainDeletedItemsFor is 30 on a sample of mailboxes.
• On a test mailbox with a retention policy, delete an item, wait for the Managed Folder Assistant (or run Start-ManagedFolderAssistant -Identity test@contoso.com), and confirm Content Search finds the deleted item.
• Create a test hold, delete the account, and confirm the inactive mailbox appears, then practice searching it.
• Restore a test user from Deleted users, and time it.
• Run the audit search for a known deletion and confirm you can identify who did it.

Troubleshooting

Symptom	Likely cause
Item not in the recovery view	Retention window passed, or it was purged. Check Content Search and holds
Content Search does not find a deleted item	No hold or policy was in place, or the policy has not yet reached the mailbox
Get-RecoverableItems not found or access denied	Missing role, such as Mailbox Import Export or Discovery Management
Retention policy "pending" for days	Normal propagation can take up to seven days. Check the policy status and distribution errors
Recoverable Items is full	Hold without an auto-expanding archive. Enable the archive and run the Managed Folder Assistant
Cannot place hold on mailbox	License lacks the feature
Inactive mailbox missing	No hold was in place when the account was deleted, or the hold expired
Deleted mail came back unexpectedly	A retention label or policy restored a copy to Recoverable Items, or a restore ran. Check audit logs

A Short Decision Guide

• Item deleted today, user wants it back: Recover deleted items.
• Item deleted last month: only if a hold or retention policy was in place; use Content Search.
• Leaver's mailbox needed for years: hold, then inactive mailbox.
• Whole mailbox lost, no hold: backup.
• "Who deleted this?": audit logs and rule audit.
• A phishing message must be removed everywhere: Content Search with purge, carefully.

Reference: Microsoft's Recoverable Items folder documentation. Related guides: retention policies and DLP, inbox rules, and shared mailboxes and leavers.

Retention values, quotas, role names, portal paths, and Microsoft 365 Backup availability come from Microsoft and change over time. I have not run these commands against your tenant, so confirm each against Microsoft's current documentation and test on a lab mailbox. If you want help designing retention, holds, and backup for a Microsoft 365 tenant, get in touch.