Single Item Recovery in O365

Ever thought of a situation where you have deleted some important emails by mistake and not being able to recover the same. It’s a dreaded situation and everyone would have thought about this situation.


In Exchange online we provide 3 layers of Recovery so that messages can be recovered

    1. Deleted Items Folder
    2. Recover Deleted Items Folder
    3. Purges Folder



Deleted Items Folder

When a mail is deleted(normal Delete not shift Delete) its moved to Deleted Items folder and its present there until we manually delete the messages from there or its deleted automatically or according ti the duration set by the administrator (By default messages are stored indefinitely)

Extended email retention for deleted items in Office 365


Recover Deleted Items Folder 

When a mail is Shift deleted(hard deleted), or deleted from Deleted items or removed from deleted items by the Retention policy, its moved to the Recover Deleted Items Folder and it remains there for next 14 days(can be extended to 30 days).


There are 2 folders under Recovery Deleted Items

    1. Deleted Folder(its not the normal Deleted folder in the mailbox)
    2. Purges Folder


When the mail is present in Recovery Deleted Items(Deleted folder) it can be directly recovered from the users Outlook or OWA


In Outlook 2007, click on Tools and select  Recovery Deleted Items  as shown below



In Outlook 2010 under Folder Option  in the Ribbon bar we have Recovery Deleted Items 



In OWA when we right click Delete Items folder we have the option to open Recover Deleted Items Folder.





Purges folder 

When a mail is deleted from Deleted Items folder under Recover Deleted Items its moved to Purges Folder under  Recover Deleted Items folder. Refer the image shown in this link

Remember the shell life of a message moved to Recover Deleted Items is 14 days(can be extended to 30 days) regardless its moved to Deleted Folder or Purges folder. The time starts as soon as the message is moved to Recover Deleted Items.


Once the mail moves to Purges Folder its not visible for the end user(either in Outlook 2007/2010 or OWA) and we have 2 ways to recover these messages, if its still present in Purges Folder

Method 1 : Using ECP

Please logon to Portal > Outlook > Options > See  All options

At the left top corner select Manage My Organization  

Select Roles & Auditing  > Administrator Roles  >  and double click Discovery Management  and make sure you are part of this group


Once that is verified please Double click Organization Management > Under Roles Click on Add and Select Mailbox Import Export

Under Member, Add yourself as a Member and Click Save.



Select Mail Control > Discovery and Select New



Please fill in the details so that all mails that was sent and received form the particular user's account is selected and click on Save



Under Search Name, Type and Storage Location  make sure Copy the search results to the destination mailbox is selected and default Discovery Mailbox is selected.

Once the search is completed you would get an option to open the the Discovery Search mailbox

Alternatively you can store the results to the users mailbox using Search-Mailbox cmd, refer



Method 2 : Using MFCMAPI

Note: Although the use of MFCMAPI is supported by Exchange Online we recommend that you use caution be used at all times when making modifications to mailboxes by using this tool. Using the MFCMAPI tool incorrectly can cause permanent damage to a mailbox.

Download MFCMAPI tool from here

Install this on the user's machine whose messages need to be recovered.


Select Tools > Options 



Make sure the below highlighted option is selected and click ok


Click Session > Logon > and select the Profile of the user on which you want to do a Single Item Recovery from the dropdown list





Double click on user's account Default store

Expand the Root Container and double click on Purges folder as shown below


On the Purges folder Window , do a Select All (Ctrl + A) you can either do

1)      Export message as (MSG (Ansi)) or

2)      Delete Message, this gives us an option “Delete to Deleted Items” and you can find the emails in the deleted folder


Being the admin of an Tenant we have the right to increase the Single Item Recovery period of users of our domain to 30 days maximum from the default 14 days .



We can increase the value for a particular user to 30 days by running the below command

 Set-Mailbox  <user alias> -SingleItemRecoveryEnabled $True -RetainDeletedItemsFor 30


If we want to increase the recovery period for all users for 30 days we can run the below command

Get-Mailbox | Set-Mailbox -SingleItemRecoveryEnabled $True -RetainDeletedItemsFor 30


If we want to recover items for a period of more than 30 days, tenant administrator must consider using Litigation Hold.




For more information on Single Item Recovery refer the below links

Recover Deleted E-Mail Messages in Exchange Online 

Search For and Delete Messages from Users' Mailboxes

Multi-Mailbox Searches 

Put a Mailbox on Litigation Hold

Recover Deleted Items



Comments (10)

  1. Anonymous says:

    Nice One…It helps !!

  2. Sumit Arora says:

    Great stuff. Nicely done. Looking forward to more!

  3. backupoffice365 says:

    Cloud to cloud backup for leading online SaaS application. Cloud-based Office 365 combines the collaboration services to help users be productive. For more information Visit this site:

  4. Dniwe says:

    Thank you a lot for "Use the MDB_ONLINE flag when calling OpenMsgStore" option. I was unable to view RIF folders via MFCMAPI for office365 w/o this option enabled.

  5. Anonymous says:

    Here I am recycling one of my old post that I had written. Recently as there is lot of emphasis on Retention

  6. Thanks Nino Bilic for pointing out that messages by default are held in Deleted items indefinitely

    Extended email retention for deleted items in Office 365

  7. anonymouscommenter says:

    Please find the Ignite training on this topic that I delivered along with Mark on this Topic here

Skip to main content