Get full visibility and control over 320,000+ apps and browser extensions with our AI-powered assessment. Try it now.×
Home » Spin.AI Blog » Cybersecurity » Microsoft 365 » How to Recover Deleted Items in Microsoft 365
August 1, 2019 | Updated on: April 26, 2024 | Reading time 10 minutes

How to Recover Deleted Items in Microsoft 365

Author:
Avatar photo

Product Manager

A deleted Outlook email, OneDrive file, contact, an important meeting, or a Teams message can have severe consequences for the work of a single employee or a company on the whole. Apart from accidental deletions, there are many threats to data integrity in MSO 365, including ransomware, zero-day attacks, and malicious insider activity. This article showcases several ways how to recover deleted items in Microsoft 365.

The item restoration methods include:

  • Recovery from Deleted Items and Recycle Bin as a User
  • Recovery from Recoverable Items and second-stage Recycle bin as a User
  • Recover Office 365 deleted items as an Admin.

We’ll give a step-by-step guide for each of them. Note that these guidelines are written specifically for Micorosft 365 Admins.

Learn how to recover deleted emails in Outlook.

Recovery from Deleted Items and Recycle Bin

In this section we talk about the ways your users can recover items of different Microsoft 365 services. In certain cases, Admins can log in as users and restore the deleted items, for example, if you haven’t backed up your Microsoft 365, and the user doesn’t recover the item for some reason.

How to recover deleted emails in Outlook

Recovery from Deleted Items is the most common way. It consists of three easy steps:

1. Select Deleted Items in your Outlook.

2. In Deleted Items, find the email (or another item) you need to restore. Right-click on it and select Restore. The item will be restored to the folder it was deleted from. Alternatively, you can select Move and choose the folder, where the restored item will appear.

3. Good job! Your item is restored. You can find it in the folder you’ve chosen. For emails, the default folder is Inbox.

However, your email may not be in Deleted Items anymore. For example, you’ve emptied the Deleted Items folder. Also, keep in mind that Email is automatically removed after 30 days in deleted items. Try to search for your email in Recoverable Items. We’ll talk about this method later on in the article.

How to recover deleted items in OneDrive

Using the Recycle Bin to retrieve a deleted item from OneDrive is the easiest time provided you are within the 30-day recoverability period. Here’s how to do it:

1. Find the Recycle bin folder in the left panel of one drive.

2. Search for the necessary file or folder. Right-click on it. In the drop-down menu, click Restore.

3. The item will return to its previous location in OneDrive.

Keep in mind that this method is only possible for the 30 days since deletion. It also doesn’t work for the files that have been deleted from the Recycle bin.

Recovery from Recoverable Items or Second-stage recycle bin

To make sure that businesses do not lose important data, Micorosoft 365 stores items deleted from the Recycle bin and Deleted Items for 30 more days in special folders. These are the Second-stage recycle bin and Reocverable items.

How to restore emails from Recoverable items

If recovery from the Deleted Items folder is not possible, there is another way to retrieve deleted emails from Outlook. Try to search in Recoverable Items. Take the following steps:

1. Select Deleted Items in your Outlook.

2. Click Recover items deleted from this folder.

3. Find the item you are looking for. Right-click on it and select Restore. If you want to select several items, just left-click+Shift on two items and everything in between will be selected as well.

4. Done! The user’s files are restored. Depending on your Outlook version, items may be restored to the original folder or Deleted Items.

Remember, that user’s deleted items are not stored in the Recoverable Items folder forever. Depending on retention settings, you have up to 30 days until they are gone forever. To protect your corporate data from loss, check out this backup software for Office 365. It’s a great service that will keep all your business-critical data safe and sound for as long as your company needs them.

How to recover from the second-stage recycle bin as a User

To recover deleted OneDrive items from the second-stage recycle bin, you need to be logged in as a user. Keep in mind that this bin stores items for 30 days from the day the items got there.

Here’s how to recover your user’s items:

1. Go to OneDrive’s Recycle bin.

2. Scroll down to the bottom, find the link to the Second-stage recycle bin and click on it.

3. You will be redirected to the respective page. Find the item you need and right-click on it.

4. In the drop-down menu, choose Restore. The item will be restored to

Way 3: Recover Office 365 Deleted Items as an Admin

If you are a Microsoft 365 Admin, you can recover deleted Microsoft 365 items. There are some restrictions though. First of all, you need to be a Global Admin (or you will not be able to complete the process). Secondly, this way will not help you to recover the items that were purged from the Recoverable Items folder.

The main idea of this method is to use In-Place eDiscovery Hold to recover your deleted items. This process consists of retrieving the .pst file (which can be done by Admin only) and restoring the deleted email from the .pst file (which can be done by both Admin and user). This method provides a way to restore deleted calendars in Outlook 365.

Take the following steps:

1. Select the Admin app in your Office 365 account.

2. Find Admin Center and click Exchange.

3. Now you see the Exchange admin center interface. Now click Permissions.

4. Ensure the Admin Roles panel is selected. Select Discovery Management and click Edit.

5. Now you see the Discovery management window. Now click Add in the Members section (scroll down if you don’t see it). Add yourself. After that, Save the changes.

6. Sign out. Then sign in.

7. Go to Microsoft Purview. In the left-side menu, find eDiscovery and choose standard or premium.

8. You will be redirected to the eDiscovery page. Click Create a Case. Enter the case name and description if necessary. Then click on the case in the list of cases.

9. You will be redirected to the case’s page. In the top menu, click on the Searches tab. Now click New Search (plus) to create a search.

10. You will be redirected to the search creation page. Name your search. Also, you can write a description. Click Next.

11. You will be offered to activate the locations: Exchange mailboxes, Sharepoint sites, and Exchange public folders. Upon the activation of the location, you will be able to choose users, groups, or teams for Exchange mailboxes and sites for Sharepoint. Set the configuration in a manner that matches your search needs. Click Next

12. Now you can configure your search. You can use the KQL editor or simply create conditions in the Query builder. By default, you will have the condition Keywords. Type in the keywords of the email or document you are looking for.

You can also add other conditions like Title, Sender, Type, Created, etc. as well options like contains any of / none of or equals any of / none of. Upon creating the second condition you can delete the first one by pressing a bin icon.

13. Check the search parameter as the last step of search creation and Click Submit.

14. You will be redirected back to the case page. Your new search will be in the list of searches. Click on it to review the status. It might take some time for the search to complete.

Once the search is done click on the Action and in the drop-down menu click Export the results.

15. Configure output options and choose how to export exchange content. Click export.

16. Now, your information is downloaded to your computer. If it’s a OneDrive document you can easily reupload it to your user’s OneDrive. The Outlook is a bit trickier. Here’s how to re-upload the Outlook file:

Your message(s) is saved in .pst format. Use Outlook on the Desktop to restore it. Open your Outlook, and find the File tab. Click Open Export and select Open Outlook Data File (remember, it should be the .pst file).

17. Now find your file and click OK.

18. Now should see the new folder in your Outlook (named after the .pst file). Find the item you have been looking for and right-click to Move it.

19. Select the folder (Inbox for an email, for example). Now, the item will appear in the selected folder.

Limitations to Office 365 Native Tools

As you see, it is possible to restore your data using Office 365 native tools. However, they have several limitations:

  • There is a time limit to restore your files. The Recoverable Items contain information for up to 30 days, depending on your retention settings.
  • You need to recover a folder item-by-item, which can be really time-consuming if there are many files in the folder.
  • If you accidentally purged the item you need to restore, it will be lost.
  • The third (admin’s) way to recover files is too complicated and time-consuming. Besides, there is no guarantee the item you are looking for is still recoverable.
  • With recovery via eDiscovery, the hierarchy of files and folders is missing. That means you’ll need to put some further effort into restoring your items to the original folders.
  • Not all Outlook versions support PST format, so you have to use Outlook on a Desktop (at least, to finalize the recovery process).

As you can see, the native Office 365 recovery options are quite limited and somewhat inconvenient, and the risk of data loss remains. That’s why you should consider protecting your data in advance. You’ll save your time and nerves. Moreover, you’ll ensure that your items are never gone.

Make Recovery Fast and Reliable with Spinbackup

We all need to recover deleted items, sooner or later. Also, you might need to recover deleted folders in Microsoft Outlook, not just one item. Because native Office 365 recovery tools have flaws, you need a reliable third-party cloud service that will make sure your data is always protected.

Spinbackup is one of the best Office 365 Backup Recovery solutions. This product will allow you to backup your Outlook and Onedrive items including Calendars and Contacts. Your backup data will be stored in the cloud of your choice (Amazon AWS or Google’s GCP), and you can recover your items in just a few clicks at any time.

P.S.: If you need to know how to recover your Google account, read this article!

Start 15-Day Free Trial

Frequently Asked Questions

Can you recover deleted files from Microsoft 365?

Yes, you can recover deleted items in Microsoft 365. There are three major ways to do this including the Recovery from Deleted Items, Recovery from Recoverable Items, and Recover Office 365 deleted items as an Admin.

How do I recover permanently deleted emails from Office 365?

You can recover permanently deleted items from the Recoverable Items. For this, select Deleted Items and click Recover items deleted from this folder. Find the item you are looking for and click Restore. Note, that depending on the retention settings, you have up to 30 days to recover your data. To widen the recovery window, try Spinbackup which will keep all your data safe and available for as long as you need them.

Does Microsoft 365 have a Recycle Bin?

Microsoft 365 has a Deleted Items folder which can be compared to the Recycle Bin. So, when you delete items in Microsoft 365, they are initially moved to the “Deleted Items” folder.

Was this helpful?

Thanks for your feedback!
Avatar photo

Written by

Product Manager at Spin.AI

Will Tran is the Product Manager at Spin.AI, where he guides the product's strategic direction, oversees feature development and ensures that the solution solves his clients’ cybersecurity needs.

Will is a security professional who started his career at Lockheed Martin where he worked on National Security Space programs in business development and product management.

Will holds a BA in Economics and Mathematics from UCSB and an MBA with a specialization in Technology Management and Marketing from UCLA Anderson School of Management.

At Lockheed Martin, Will developed the multi-year strategy campaign and supported the product development of a national security satellite program for the United States Air Force, which resulted in a multi-billion dollar contract.

During business school, Will consulted 2 non-profit organizations as part of a series of national consulting case competitions. He set strategic priorities, optimized business operations, and developed a process to qualify new revenue streams for his non-profit clients. These initiatives resulted in 15-20% increase in annual surplus.

In his spare time, Will can be found at local coffee shops around Los Angeles, traveling to different countries, or hanging out with his cat.

How Can You Maximize SaaS Security Benefits?

Let's get started with a live demo

Latest blog posts

Data Loss Prevention: Protecting Your Gold

In today’s digital landscape, data is one of the most valuable assets to your company....

Avatar photo

CEO and Founder

Read more

Obsidian Security vs. Spin.AI: Comparing Popular SSPM Solutions

Partnering with third-party applications and browser extensions have clear benefits to increasing the efficiency of...

Avatar photo

Product Manager

Read more
What is the NIS2 Directive Compliant Requirement and Checklist

What is the NIS2 Directive? Compliance Requirements and Checklist

With the rise of increasingly sophisticated cyber threats targeting all sectors, securing networks and information...

Avatar photo

Product Manager

Read more