Delegated access to an Exchange mailbox is a double-edged sword. It enhances collaboration but can also leads to accidental or even intentional email deletions. Events like these raise security concerns and emphasize the need to track email actions to find who deleted emails in Outlook. If you're an admin struggling to audit email deletions in Office 365, our guide is a one-stop shop.
Windows PowerShell Connect-ExchangeOnline Windows PowerShell Search-UnifiedAuditLog -StartDate "<MM/DD/YYYY hh:mm tt>" -EndDate "<MM/DD/YYYY hh:mm tt>" -Operations SoftDelete, HardDelete, MoveToDeletedItems |ft 
The AdminDroid Exchange Online auditing tool offers valuable insights and provides control over Microsoft 365 deleted emails across your environment. This empowers you in any investigations if any suspicious email deletions are found.
Receive immediate alerts when an Exchange email deletion occurs to stay informed, proactive, and safeguard important data.
Frequently audit Exchange Online inbox rules to identify any configurations that automatically delete emails to prevent unintended deletions.
Customize the report with rich filters to easily identify and track specific email deletion activities within the required time range.
Regularly track non-owner mailbox access and revoke access for stale or unwanted users based on the insights to prevent any careless email deletions.
Identify Exchange Online mailbox permission changes to find anonymous access rights and prevent unauthorized email deletions from shared or other users' mailboxes.
Schedule the email deletions report and get them delivered via emails at predefined intervals for a daily or weekly review for proactive monitoring.
In conclusion, AdminDroid's Exchange Online management simplifies email deletion audits with advanced filters, customization, and graphical visualization. Leveraging AdminDroid’s features, admins can stay proactive and make Microsoft 365 management easier.
This error occurs when the specified 'RetainDeletedItemsFor' value exceeds the maximum permissible days (30).
Set-Mailbox –Identity <Mailbox UPN> -RetainDeletedItemsFor 30This error occurs when attempting to recover deleted items without the mailbox import export permission.
This error arises when using an already used name for a compliance search.
This warning occurs when the single item recovery state remains unchanged after executing the Set-Mailbox cmdlet.
Get-Mailbox -Identity <Mailbox UPN> | Select SingleItemRecoveryEnabledThis error occurs when you haven't been assigned the eDiscovery manager role required to perform content searches.
When you delete an email in Exchange Online, the process and consequences are as below.
To change how long deleted items are kept in Outlook, run the following cmdlet in the Exchange Online PowerShell.
Set-Mailbox -Identity <User’s UPN> -RetainDeletedItemsFor <Days>You can use AdminDroid’s Mailbox Retention Settings report to determine the deleted item’s retention duration for all the mailboxes in your Microsoft 365 tenant.
Handy Hint: Use the Advanced Customization option to apply filters to the report, sort data, and select specific columns for enhanced visibility. You can also create a custom view and save it for future use.
Yes, the retention policies in Exchange Online can automatically delete emails based on the criteria defined in the policy. In essence, retention policies are designed to manage the lifecycle of content in Microsoft 365 by retaining, archiving, or deleting the content after some period.
By default, the policy named Default MRM Policy is applied to all the mailboxes in your Exchange Online environment. But it is not configured to delete any emails from the mailbox. However, custom retention policies created by admins, or the modified default policy can potentially mass delete emails if configured to do so.
Unfortunately, auditing the deletion of emails by retention policies isn't feasible. As it's an automated process, Microsoft bypasses recording these deletions in the purview audit logs.
Auditing bulk email deletions in Microsoft 365 provides the ability to monitor and track large-scale deletions of emails by users.
For monitoring email deletions in Microsoft 365, it's essential to ensure that audit log is enabled for all mailboxes in your Microsoft 365 tenant.
To simplify this process, use AdminDroid's Exchange mailbox audit settings report to verify if the audit log is enabled or bypassed for the mailboxes.
Handy Hint: Use the Email this report now option to send reports directly in your preferred format from your authorized email ID to your chosen recipients.
To find and recover deleted emails in Microsoft Outlook, follow the steps.
Note: If you have already deleted the message from this folder or if you have used Shift + Delete for a direct soft delete or if any retention policy has configured soft deletion, the email will be moved to the Recoverable Items.
To restore the soft deleted emails from the Recoverable Items in Outlook, do the following steps.
If the emails are hard deleted (deleted from Recoverable Items in Outlook), they are moved to the Purges folder, which is not visible to users. Admins can recover permanently deleted emails in Outlook 365 if the single item recovery is enabled for that mailbox.
As an admin, you possess the capability to recover the hard deleted emails in Office 365 using Exchange admin center.
Note: This action requires the admin to have the Mailbox Import Export permission. If you don’t have it, use the Exchange admin center to create role groups with the Mailbox Import Export permission.
Get-Mailbox -Identity <Mailbox UPN> | Select SingleItemRecoveryEnabledSet-Mailbox -Identity <Mailbox UPN> -SingleItemRecoveryEnabled $trueSince shared mailboxes are configured for access among multiple users, there's an increased risk of accidental or anonymous email deletions. Therefore, it's crucial to find out who deleted emails from a shared mailbox for efficient workflow management and to potentially retrieve lost emails.
While shared mailboxes pose risks due to their broad accessibility, users with delegated access are also susceptible to such unauthorized email deletion issues. However, the risk is generally lower in user mailboxes with limited delegate permissions.
The process to track who deleted emails from the shared mailbox or user mailbox remains the same. To track who deleted emails from a specific Exchange Online mailbox, run the AuditDeletedEmails.ps1 script with 'Mailbox' parameter.
.\AuditDeletedEmails.ps1 -Mailbox <Mailbox UPN>
Get AdminDroid Office 365 Reporter Now!