Monday, 16 April 2018

Recover Deleted Emails in Office 365 Mailbox using PowerShell

As an Administrator you might requested by an Outlook user to restore the deleted e-mail messages. In Office 365, you can search and restore the deleted items using Exchange Online Powershell cmdlets Get-RecoverableItems and Restore-RecoverableItems.

Before proceed, first we need to connect Exchange Online powershel module by running below commands:
$o365Cred = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri -Credential $o365Cred -Authentication Basic -AllowRedirection
Import-PSSession $Session


Permissions Required :

To run the cmdlets Get-RecoverableItems and Restore-RecoverableItems, you must have one of the Exchange RBAC roles with the "Mailbox Import Export Role" assigned. By default, this role isn't assigned to any role group. Typically, you assign a role to a built-in or custom role group. Or you can assign a role to a user, or a universal security group. The below example add the role to the Organization Management role group:
New-ManagementRoleAssignment -Name "Import_Export_Organization_Management" -SecurityGroup "Organization Management" -Role "Mailbox Import Export"
Note: You have to create a new Exchange Online PowerShell session to get new role permissions.

Restore deleted messages to their original folder location:

We can use the Restore-RecoverableItems cmdlet to restore each item to its original location and this cmdlet takes the same search parameters that you used to find items.
Restore-RecoverableItems -Identity "AlexW" -SourceFolder RecoverableItems -SubjectContains "Important”

Restore deleted messages from bulk users mailbox:

You can use the below powershell commands if you want restore deleted emails from set of users' mailbox by importing user details from CSV file.
Import-Csv 'C:\Users.csv' | ForEach-Object {
$mailbox = $_."UserPrincipalName"
Write-Host "Recovering messages for" $mailbox -Foreground Yellow
Restore-RecoverableItems -Identity $mailbox -SourceFolder RecoverableItems -SubjectContains "Important" -FilterItemType Ipm.Note


No comments:

Post a Comment