"It was deleted by mistake" can mean three different things in Exchange Online: email a user purged, a mailbox that disappeared with its user account, or a leaver's mailbox kept on hold. Each one has its own retention window and its own tool. In this post I'll match each case to the right method, walk through the commands and show how to confirm the data is back.
How it works#
| What was deleted | Recoverable for | Tool |
|---|---|---|
| Items in a mailbox, including purged ones | The deleted item retention period (14 days by default, up to 30), or longer under a hold | Outlook for users; EAC or Restore-RecoverableItems for admins |
| A mailbox whose user account was deleted (soft-deleted) | 30 days | Restore the user, Undo-SoftDeletedMailbox or New-MailboxRestoreRequest |
| A mailbox whose license was removed | 30-day grace period | Assign the license again |
| A mailbox on hold when its account was deleted (inactive) | As long as the hold applies | New-MailboxRestoreRequest, or recover it as a new mailbox |
Single item recovery is on by default for new Exchange Online mailboxes. That means an admin can still recover items a user has purged until the deleted item retention period runs out. After that, unless a hold applies, the items are gone for good.
Prerequisites#
- Exchange Online PowerShell (
Connect-ExchangeOnline). - The Mailbox Import Export role for item recovery. No role group has it by default, so add it to one in the Exchange admin center under Roles › Admin roles.
- A role that can restore users in the Microsoft 365 admin center, such as User Administrator.
- Know which case you have.
Get-Mailbox -SoftDeletedMailboxandGet-Mailbox -InactiveMailboxOnlyshow deleted and inactive mailboxes.
Step-by-step#
1. Recover deleted items#
Users can recover what's still in Recoverable Items themselves, with the recover deleted items option in their Deleted Items folder in Outlook or Outlook on the web. Purged items, and items removed by a retention policy, need an admin. In the EAC, go to Recipients › Mailboxes, select the mailbox, and under Others select Recover deleted items. Filter, select the messages and choose Recover deleted items. In PowerShell, search first and narrow until only the items you want are returned, then restore with the same filters:
Get-RecoverableItems -Identity laura@contoso.com -SubjectContains "Quarterly report" -FilterItemType IPM.Note `
-FilterStartTime "9/1/2026 12:00:00 AM" -FilterEndTime "9/30/2026 11:59:59 PM"
Restore-RecoverableItems -Identity laura@contoso.com -SubjectContains "Quarterly report" -FilterItemType IPM.Note `
-FilterStartTime "9/1/2026 12:00:00 AM" -FilterEndTime "9/30/2026 11:59:59 PM"Restore-RecoverableItems accepts several mailboxes, and -MaxParallelSize controls how many it processes at once. To give users longer next time, run Set-Mailbox -RetainDeletedItemsFor 30.
2. Bring back a soft-deleted mailbox#
If the user account was deleted within the last 30 days, restore it in the Microsoft 365 admin center under Users › Deleted users. The mailbox comes back with it. Microsoft recommends restoring from the same place the deletion happened (Microsoft Entra ID or Exchange Online), because a restore from the other side fails. If the mailbox was removed with Remove-Mailbox:
Get-Mailbox -SoftDeletedMailbox | Format-Table Name, PrimarySmtpAddress, ExchangeGuid, WhenSoftDeleted
Undo-SoftDeletedMailbox allieb@contoso.com -WindowsLiveID allieb@contoso.com -Password (Read-Host "Enter password" -AsSecureString)
# Or copy the content into another mailbox (for example in hybrid, when the Entra user was hard-deleted)
New-MailboxRestoreRequest -SourceMailbox <SoftDeletedMailboxGuid> -TargetMailbox <TargetMailboxGuid>Watch out: In hybrid, if a new user with the same ExchangeGuid or ArchiveGuid is synchronized from on-premises within those 30 days, you get an ExchangeGuid validation conflict. If that new account is licensed for Exchange Online, Microsoft documents that the original mailbox is hard-deleted.
3. License removed#
Exchange Online keeps the data for 30 days after the license is removed. Assign the license again within that time and the mailbox becomes fully active. While it's unlicensed, eDiscovery tools such as Content search can't search it.
4. Restore or recover an inactive mailbox#
A mailbox becomes inactive if a hold or retention policy covers it when the user account is deleted (see retention policies and litigation hold in Exchange Online). You have two options:
- Restore copies the content into an existing mailbox. The inactive mailbox stays as it is. Use PowerShell; the EAC and the Microsoft Purview portal can't do this.
- Recover converts the inactive mailbox into a new mailbox with a new user account, using
New-Mailboxwith the-InactiveMailboxparameter. After that, the inactive mailbox no longer exists.
Get-Mailbox -InactiveMailboxOnly |
Format-List Name, PrimarySmtpAddress, DistinguishedName, ExchangeGuid, LegacyExchangeDN, ArchiveStatus
# Identify it by DistinguishedName or ExchangeGuid, not by SMTP address
$inactive = Get-Mailbox -InactiveMailboxOnly -Identity "<DistinguishedName or ExchangeGuid>"
# The restore checks LegacyExchangeDN, so add it to the target as an X500 address
Set-Mailbox -Identity manager@contoso.com -EmailAddresses @{Add="X500:$($inactive.LegacyExchangeDN)"}
New-MailboxRestoreRequest -SourceMailbox $inactive.DistinguishedName -TargetMailbox manager@contoso.com -TargetRootFolder "Inactive Mailbox"
# Archive to archive: add -SourceIsArchive and -TargetIsArchiveWithout -TargetRootFolder, the items merge into the matching default folders of the target. Items in an old mailbox can be well past the target's retention settings, so Microsoft suggests turning on retention hold for the target first (Set-Mailbox -RetentionHoldEnabled $true).
Verify#
Get-MailboxRestoreRequest | Get-MailboxRestoreRequestStatistics | Format-Table Name, Status, PercentComplete
Get-MailboxRestoreRequestStatistics -Identity "<RequestIdentity>" -IncludeReport | Format-List Status, PercentComplete- Restore requests: good looks like
Completedand 100 percent. After that you can remove the X500 address from the target if you like. - Item recovery: run
Get-RecoverableItemsagain with the same filters. The restored items shouldn't appear any more, and the user should see them in the mailbox. - Soft-deleted mailbox:
Get-Mailbox -Identity allieb@contoso.comreturns the mailbox again, and the user can sign in to Outlook on the web.
Tips & gotchas#
- The windows are hard limits. Once an account is deleted, only a hold or retention policy that was already in place keeps its mailbox beyond 30 days, so set that up for leavers before you delete anyone.
- Auto-expanding archives. You can't recover or restore an inactive mailbox that has an auto-expanding archive. Microsoft points to Content search export, for eDiscovery purposes only. See auto-expanding archiving in Exchange Online.
- Email data only. Restore and recover don't bring back application data stored in hidden mailbox folders.
- Recoverable Items full? That's a quota problem rather than a recovery one. See "Mailbox full" in Exchange Online.
- For Exchange Server, see recovering a deleted mailbox in Exchange Server.
