As an Administrator you might requested by an Outlook user to restore the deleted e-mail messages. In Office 365, you can search and restore the deleted items using Exchange Online Powershell cmdlets Get-RecoverableItems and Restore-RecoverableItems.
Before proceed, first we need to connect Exchange Online powershel module by running below commands:
$o365Cred = Get-Credential $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $o365Cred -Authentication Basic -AllowRedirection Import-PSSession $Session
Summary
- Permissions Required
- Search deleted messages in Recoverable and Deleted Items folders
- Restore deleted messages to their original folder location
- Restore deleted emails for bulk users
Permissions Required
To run the cmdlets Get-RecoverableItems and Restore-RecoverableItems, you must have one of the Exchange RBAC roles with the “Mailbox Import Export Role” assigned. By default, this role isn’t assigned to any role group. Typically, you assign a role to a built-in or custom role group. Or you can assign a role to a user, or a universal security group. The below example add the role to the Organization Management role group:
New-ManagementRoleAssignment -Name "Import_Export_Organization_Management" -SecurityGroup "Organization Management" -Role "Mailbox Import Export"
Note: You have to create a new Exchange Online PowerShell session to get new role permissions.
Search deleted messages in Recoverable and Deleted Items folders
We can use the Get-RecoverableItems cmdlet to search the Deleted and Recoverable Items folders based on a specific set of properties with basic search query.
Get-RecoverableItems -Identity "AlexW" -SourceFolder RecoverableItems -FilterItemType Ipm.Note -FilterStartTime "4/15/2018 01:00:00" -FilterEndTime "4/16/2018 22:00:00"
When users delete mail items by SHIFT/Delete key combination, the deleted mail items directly moved into Recoverable Items folder by bypassing Deleted Items folder. In the above command we need to specify the parameter FilterItemType as “Ipm.Note” to search only mail items. Likewise, you can specify different types of items to search (Ex: Ipm.Appointment to search calendar item, Ipm.Contact for contact).
Search deleted mails by subject:
In some cases, users might not be sure when the message was deleted, but they might be able to tell you the message subject. In this case, you can easily filter messages by subject:
Get-RecoverableItems -Identity "AlexW" -SourceFolder RecoverableItems -SubjectContains "Important”
You can also search the Deleted Items folder (Soft Delete) as same way.
Get-RecoverableItems -Identity "AlexW" -SourceFolder DeletedItems -SubjectContains "Important”
Restore deleted messages to their original folder location
We can use the Restore-RecoverableItems cmdlet to restore each item to its original location and this cmdlet takes the same search parameters that you used to find items.
Restore-RecoverableItems -Identity "AlexW" -SourceFolder RecoverableItems -SubjectContains "Important”
Restore deleted messages from bulk users mailbox
You can use the below powershell commands if you want restore deleted emails from set of users’ mailbox by importing user details from CSV file.
Import-Csv 'C:\Users.csv' | ForEach-Object {
$mailbox = $_."UserPrincipalName"
Write-Host "Recovering messages for" $mailbox -Foreground Yellow
Restore-RecoverableItems -Identity $mailbox -SourceFolder RecoverableItems -SubjectContains "Important" -FilterItemType Ipm.Note
}