A deleted email in Exchange Online is rarely gone the moment it disappears. Exchange keeps several layers of safety net between “the user pressed delete” and “the message no longer exists,” and knowing those layers is the difference between a 30-second fix and telling someone their mail is lost forever.
This guide walks the recovery path in order, from the obvious (the Deleted Items folder) to the not-so-obvious (the hidden Recoverable Items dumpster), then covers the retention windows that decide how long you actually have, single item recovery, and what an admin can pull back when a user has done their best to destroy something.
How deletion actually works in Exchange Online
Mail moves through stages, and recovery depends on which stage it’s reached. Understanding the flow first makes every step below obvious.
The stages a deleted message passes through
| 1. Deleted Items | Normal delete moves the message to the Deleted Items (Trash) folder. The user can still see and restore it. |
|---|---|
| 2. Recoverable Items (Deletions) | Emptying Deleted Items, or a Shift+Delete, moves it here. Hidden from the folder list but recoverable by the user. |
| 3. Recoverable Items (Purges) | If a user purges from the dumpster, items land here when single item recovery or a hold is on. Recoverable by an admin only. |
| 4. Permanently removed | Once retention expires with no hold, the item is gone for good. |
The takeaway: most “I deleted it permanently!” panics are still at stage 2 or 3, which are both recoverable. Don’t assume mail is lost just because it’s not in Deleted Items.
Level 1: Restore from Deleted Items
The first stop is the obvious one, and it solves most requests.
- In Outlook or Outlook on the web (OWA), open the Deleted Items folder.
- Find the message.
- Right-click it and choose Move → Inbox (or drag it back to any folder).
That’s the everyday case — a user deleted something, hasn’t emptied the trash, and just needs it back. If it’s there, you’re done.
Level 2: Recover Deleted Items (the dumpster)
When the message isn’t in Deleted Items — the user emptied the folder, or used Shift+Delete to skip it — it’s almost certainly sitting in Recoverable Items. This is the hidden folder people don’t know exists, and it’s where most “permanently deleted” mail actually lives.
In Outlook on the web (OWA):
- Right-click the Deleted Items folder.
- Choose Recover deleted items.
- Select the messages and click Restore. They return to Deleted Items, then move them where you want.
In the Outlook desktop client:
- Select the Deleted Items folder.
- On the Folder tab (or Home in newer builds), click Recover Deleted Items From Server.
- Pick the items, choose Restore Selected Items, and click OK.
The time limits that decide everything
Recovery is a race against retention. Here are the defaults that matter, and where they’re set.
Default retention windows
| Deleted Items folder | Kept until the user empties it (or a retention policy clears it, often 30 days) |
|---|---|
| Deleted item retention (dumpster) | 14 days by default, configurable up to 30 days per mailbox |
| With single item recovery on | Items held in Purges for the retention period even if the user purges them |
| With litigation hold / retention policy | Preserved well beyond the defaults, for as long as the hold applies |
The 14-day deleted item retention is the number that catches people out. After mail leaves Deleted Items, you generally have two weeks (unless raised to 30, or a hold is in place) before it’s purged for good. You can extend the retention window per mailbox with PowerShell:
# Connect first (ExchangeOnlineManagement module)
Connect-ExchangeOnline
# Raise deleted item retention to the 30-day maximum for one mailbox
Set-Mailbox -Identity [email protected] -RetainDeletedItemsFor 30.00:00:00Single item recovery: turn it on for everyone
Single item recovery (SIR) stops a user from permanently purging mail inside the retention window. With it on, even items the user tries to destroy from the dumpster are held in the Purges subfolder until retention expires — and an admin can still get them back. It’s the setting that turns “the user nuked it” from a disaster into a recoverable event.
Check and enable it per mailbox:
# Check current status for a mailbox
Get-Mailbox -Identity [email protected] |
Select-Object DisplayName, SingleItemRecoveryEnabled, RetainDeletedItemsFor
# Enable it (and set retention to 30 days while you're here)
Set-Mailbox -Identity [email protected] `
-SingleItemRecoveryEnabled $true -RetainDeletedItemsFor 30.00:00:00
# Enable it for every user mailbox in the tenant
Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox |
Set-Mailbox -SingleItemRecoveryEnabled $true -RetainDeletedItemsFor 30.00:00:00Admin recovery: when the user can’t get it
If a user has purged an item out of the dumpster and single item recovery (or a hold) was on, the message is in the Purges folder, invisible to the user but reachable by an admin. The way you retrieve it is a content search in the compliance tooling:
- Go to the Microsoft Purview compliance portal (
compliance.microsoft.com/purview.microsoft.com). - Open Content search and create a new search scoped to the user’s mailbox.
- Add conditions (sender, subject, date range) to find the specific items.
- Run the search, review the results, and export the matching items to recover them.
This reaches into Recoverable Items including Purges, which the user-facing tools can’t. It’s the right tool when something was deliberately purged but is still inside its retention window or covered by a hold.
A quick recovery decision path
When a user reports missing mail, work down this list — it maps directly to the layers above:
Where to look, in order
- Check Deleted Items first — most mail is still there
- Not there? Use Recover Deleted Items (the dumpster) in OWA or Outlook
- Still missing and recently purged? Check single item recovery, then run a content search as admin
- Confirm the deleted item retention window (default 14 days) hasn't passed
- If a litigation hold or retention policy applies, the mail is preserved regardless of user deletion
Wrapping up
Exchange Online is forgiving about deletion if you act inside the retention window. Start in Deleted Items, fall back to Recover Deleted Items for anything emptied or Shift+Deleted, and use an admin content search for items purged out of the dumpster. The whole thing hinges on time and configuration: the default 14-day deleted item retention, single item recovery being on, and any holds in place. Set those up across the tenant ahead of time and most “I lost an email” tickets become a one-minute restore.
For related mailbox administration, see our guides on exporting a Microsoft 365 mailbox to PST for keeping a local copy of important mail, and creating a shared mailbox for team addresses.
