Deleted emails are one of the most common recovery requests IT teams handle. An employee cleans out a folder, a mailbox rule moves messages somewhere unexpected, a former employee’s mailbox needs to be searched, or ransomware tampers with mail synced to a device. How you restore those messages depends on how long ago they were deleted and what protection you have in place.
Here is a step-by-step guide, starting with Microsoft’s built-in options and moving to a dedicated Microsoft 365 backup when native tools are not enough.
Step 1: Check The Deleted Items Folder
Ask the user to open Deleted Items in Outlook or Outlook on the web. Messages deleted normally land here first. Right-click and choose Restore or move them back to the original folder.
Step 2: Recover From Recoverable Items
If Deleted Items was emptied, messages may still be in the Recoverable Items folder. In Outlook, select Deleted Items and choose “Recover items recently removed from this folder.” Select the messages and restore them. Items remain here only for a limited retention period set by your organization’s policies.
Step 3: Use Admin Tools For Wider Searches
Administrators can search mailboxes using Microsoft Purview content search or eDiscovery tools to locate deleted messages that users cannot find themselves, especially when a litigation hold or retention policy is in place. This requires proper permissions and should follow your company’s privacy and legal procedures.
When Native Recovery Is Not Enough
Built-in options fall short when:
- The retention window has expired and messages were permanently purged
- A user’s license was removed and the mailbox was deleted
- You need to restore an entire mailbox to a specific point in time
- An attacker or malicious insider deleted large amounts of mail
- Retention settings were changed or never configured
This is where a dedicated Microsoft 365 backup becomes essential.
Step 4: Log In To Your Microsoft 365 Backup Console
Third-party backup platforms store copies of Exchange Online data outside your Microsoft tenant. Sign in to the backup console with an account protected by multi-factor authentication.
Step 5: Locate The Mailbox And Restore Point
Select the user’s mailbox and choose a backup date before the emails were deleted. Most platforms show a calendar or snapshot list so you can pick the right point in time.
Step 6: Search For The Specific Messages
Use search filters such as sender, subject, date range, keywords, or folder to find the exact emails you need. Granular search lets you restore a single message instead of rolling back the entire mailbox.
Step 7: Choose The Restore Destination
Decide where restored items should go:
- Original location: returns messages to their original folders
- Separate restore folder: places items in a new folder so nothing current is overwritten, often the safest option
- Another mailbox: useful when recovering a departed employee’s mail for a manager
- Export: downloads messages as a PST or EML files for legal or archival needs
Step 8: Run The Restore And Verify
Start the restore and monitor its progress. When complete, confirm with the user that the right messages, attachments, and folder structure are back. Document the request and outcome for your records.
Step 9: Find Out Why It Happened
If emails disappeared unexpectedly, investigate. Check for malicious inbox rules, suspicious sign-ins, or signs of a compromised account. Mass deletions can be an early warning of an attack.
Best Practices To Avoid Future Loss
- Back up Exchange Online automatically several times a day
- Keep backups outside Microsoft’s environment with immutable retention
- Back up mailboxes before removing licenses from departing employees
- Protect admin accounts with MFA and limit global administrators
- Test restores regularly, including full mailbox recovery
CTS Companies provides Microsoft 365 backup and recovery in Michigan, with fast, granular restores of email, OneDrive, SharePoint, and Teams. Our help desk team handles restore requests so your staff do not have to. Talk to an expert today.