While the IT toolset for recovering deleted data is robust, there is still quite a bit to be desired from interactions with specialized database objects like ahem…Email.
The problem: Office 365 user, using Outlook on desktop, User deleted a large-ish set of folders containing 30,000 emails. They show up in the Deleted Items folder when you click on the Recoverable Items folder. To get them back through the GUI, you need to recover each email, then restore each one from the Deleted Items folder. Thats a lot of work when dealing with 30,000. So I look to PowerShell.
For this to work you will need the ExchangeOnlineManagement module installed. You can refer to this page for some info on that, though any software versions referenced are now outdated: Microsoft 365 PowerShell connect to Exchange tenant | IT by Mitch
What to look for, what to ignore:
The first place I was pointed was to PowerShell commands that exist only in on-prem exchange shell. If that’s your environment then great, you will find the restore easy. You can google those instructions.
Next was Compliance Searches. CoPilot makes it sound so straightforward, but buries the fact that even if you can get your search to return the correct result set, you can only take action on 10 items at a time due to these functions being created for smaller remediation, not for bulk mailbox cleanups.
What you want to use is Get-RecoverableItems and Restore-RecoverableItems
These cmdlets are only available to the Mailbox Import Export Role and be default that role is not assigned to any role groups. Some orgs may have it configured already as part of a past need (like when you transition from on-prem to cloud for example). At any rate, you might need to get this permission:
- In the EAC: Goto Roles / Admin Roles and add Mailbox Import Export to a role group (Microsoft gives the example of the Organization Management role). Make sure you have that role or are a member of a group that will have that role.
Once you have permission, build your PowerShell commands:
Get-RecoverableItems (ExchangePowerShell) | Microsoft Learn
Restore-RecoverableItems (ExchangePowerShell) | Microsoft Learn
Example: Get-RecoverableItems <UPN> | Restore-RecoverableItems -FilterStartTime 01/01/2025 -FilterEndTime 01/08/2025 -NoOutput
This command will both get and recover all the items deleted between 1/1 and 1/8.
It uses the LastModifiedTime value of each item.
I would highly suggest using -NoOutput if you are taking action on a large number of messages, or else you’ll see all of them come up in your PS window.
