Recover a Deleted Mailbox Within 30 Days

In Microsoft 365, when a user account is deleted, the associated Exchange Online mailbox does not disappear immediately. Instead, it enters a…

In Microsoft 365, when a user account is deleted, the associated Exchange Online mailbox does not disappear immediately. Instead, it enters a "soft-deleted" state for a default period of 30 days. This mechanism provides a critical window for administrators to recover mailboxes, preventing permanent data loss due to accidental or erroneous user deletions. This article details the procedures and considerations for recovering these soft-deleted mailboxes within that 30-day retention period.

Understanding Soft-Deleted Mailboxes

When an Azure Active Directory (AAD) user object is deleted, whether through the Microsoft 365 admin center, Azure portal, or PowerShell, its corresponding Exchange Online mailbox transitions to a soft-deleted state. During this 30-day period (configurable up to 30 days, not beyond, unlike item retention), the mailbox is disconnected from the user account but still resides in the Exchange Online database. It consumes storage but is not accessible by any user. After 30 days, the soft-deleted mailbox is permanently purged from Exchange Online and cannot be recovered by Microsoft 365 administrators through standard means.

Key characteristics of a soft-deleted mailbox:

  • Disconnected: No associated active user account.
  • Recoverable: Can be reconnected to a new or existing user account within 30 days.
  • Invisible: Does not appear in standard mailbox lists (e.g., Get-Mailbox) without specific parameters.
  • Storage Consuming: Continues to use storage quota until purged.

Identifying Soft-Deleted Mailboxes

Before initiating a recovery, you need to identify the soft-deleted mailbox. This is done using PowerShell connected to Exchange Online. Ensure you have the Exchange Online PowerShell module installed and authenticated.

Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com -ShowProgress $true

To list all soft-deleted mailboxes in your organization:

Get-Mailbox -SoftDeletedMailbox

To find a specific soft-deleted mailbox, you can filter by various attributes, such as the original user's display name or email address:

Get-Mailbox -SoftDeletedMailbox -Identity "John Doe"
Get-Mailbox -SoftDeletedMailbox -Identity "john.doe@yourdomain.com"
Get-Mailbox -SoftDeletedMailbox | Where-Object {$_.DisplayName -like "*John*"}

The output will include properties like ExchangeGUID, DisplayName, and LegacyExchangeDN, which are crucial for the recovery process.

Recovery Method 1: Reconnecting to a New User Account

This method is suitable when the original AAD user account was deleted, and you need to restore the mailbox to a newly created user account. This often happens if the user was deleted in error, and then recreated without considering the existing soft-deleted mailbox.

Step 1: Create a New User Account

Create a new user in the Microsoft 365 admin center or via Azure AD PowerShell (Microsoft Graph PowerShell SDK recommended, deprecating Azure AD PowerShell module).

# Connect to Microsoft Graph PowerShell SDK
Connect-MgGraph -Scopes "User.ReadWrite.All"

# Create a new user (example)
New-MgUser -DisplayName "John Doe" -MailNickname "john.doe" -UserPrincipalName "john.doe@yourdomain.com" -PasswordProfile @{Password="ComplexP@ssw0rd";ForceChangePasswordNextSignIn=$true} -AccountEnabled
# Assign a license afterward through the admin center or another Graph command.

Ensure this new user account has an Exchange Online license assigned to provision an empty mailbox for it.

Step 2: Get the Soft-Deleted Mailbox Details

Obtain the ExchangeGUID of the soft-deleted mailbox you wish to recover. Let's assume you found it earlier with Get-Mailbox -SoftDeletedMailbox and the ExchangeGUID is a1b2c3d4-e5f6-7890-1234-567890abcdef.

Step 3: Connect the Soft-Deleted Mailbox to the New User

Use the Connect-Mailbox cmdlet to link the soft-deleted mailbox to the new user. You'll need the new user's UserPrincipalName (or DistinguishedName, Alias, etc.) and the ExchangeGUID of the soft-deleted mailbox.

Connect-Mailbox -Identity "john.doe@yourdomain.com" -SoftDeletedMailbox -ExchangeGUID a1b2c3d4-e5f6-7890-1234-567890abcdef -Alias "john.doe"
  • -Identity: Specifies the new user account's identity.
  • -SoftDeletedMailbox: Indicates that you are connecting a soft-deleted mailbox.
  • -ExchangeGUID: The unique identifier of the soft-deleted mailbox to connect.
  • -Alias: The alias for the mailbox; typically matches the new user's alias.

After execution, the mailbox content will be accessible to the new user. Allow some time for replication across Exchange Online.

Recovery Method 2: Restoring the Original AAD User Account (Recommended)

This is the preferred method if the original AAD user account was deleted and you wish to restore both the user account and its associated mailbox. This approach preserves the user's original SID, group memberships (for cloud-only groups), and other AAD attributes, simplifying the restoration process considerably.

Step 1: Identify the Deleted AAD User

Deleted user accounts are held in a recycle bin for 30 days, similar to soft-deleted mailboxes. Use the Azure AD PowerShell module (or Microsoft Graph PowerShell SDK) to find them.

# Connect to Microsoft Graph PowerShell SDK
Connect-MgGraph -Scopes "User.Read.All", "Directory.ReadWrite.All"

# List all deleted users
Get-MgDirectoryDeletedItem -DirectoryObjectId user | Select-Object DisplayName, UserPrincipalName, Id

# Find a specific deleted user (e.g., by UserPrincipalName)
$deletedUser = Get-MgDirectoryDeletedItem -DirectoryObjectId user | Where-Object {$_.UserPrincipalName -eq "original.user@yourdomain.com"}
$deletedUserId = $deletedUser.Id

Make sure to note the Id (object ID) of the deleted user.

Step 2: Restore the Deleted AAD User Account

Use the Restore-MgDirectoryDeletedItem cmdlet with the user's object ID.

Restore-MgDirectoryDeletedItem -DirectoryObjectId $deletedUserId

Upon successful restoration, the AAD user account will be reactivated. Crucially, Exchange Online automatically detects that the original AAD user object has been restored and attempts to reconnect the soft-deleted mailbox with the same ExchangeGUID to this reactivated user. This process typically takes a few minutes to an hour.

You can verify the mailbox status by running Get-Mailbox -Identity "original.user@yourdomain.com". The mailbox should now show as a regular user mailbox and be accessible.

Note for Synchronized Identities: If your environment uses Azure AD Connect (hybrid setup) and the user was originally synchronized from an on-premises Active Directory, you cannot restore the user directly in Azure AD. You must restore the user in your on-premises AD, then force a directory synchronization. This will typically reconnect the cloud mailbox automatically.

Recovery Method 3: Restoring a Mailbox to a Different Mailbox (Mailbox Restore Request)

Sometimes you don't want to restore the entire mailbox to an active user. Instead, you might need to extract specific items or merge the content into another existing mailbox. This is achieved using New-MailboxRestoreRequest.

Step 1: Identify Source and Target Mailboxes

You need the ExchangeGUID of the soft-deleted mailbox (source) and the identity of an active mailbox (target).

$softDeletedMailboxGUID = (Get-Mailbox -SoftDeletedMailbox -Identity "John Doe").ExchangeGUID
$targetMailbox = Get-Mailbox -Identity "admin@yourdomain.com"

Step 2: Create a Mailbox Restore Request

This command copies the contents of the soft-deleted mailbox into a subfolder of the target mailbox.

New-MailboxRestoreRequest -SourceMailbox $softDeletedMailboxGUID -TargetMailbox $targetMailbox.Identity -TargetRootFolder "Recovered_JohnDoe_Mailbox" -AllowLegacyDNMismatch
  • -SourceMailbox: The ExchangeGUID of the soft-deleted mailbox.
  • -TargetMailbox: The identity of the active mailbox where content will be restored.
  • -TargetRootFolder: (Optional) Specifies a folder name in the target mailbox to place the restored content. Highly recommended for organization.
  • -AllowLegacyDNMismatch: Required when restoring a soft-deleted mailbox to a different target mailbox.

To check the status of the restore request:

Get-MailboxRestoreRequest | Get-MailboxRestoreRequestStatistics

Once the request shows a status of "Completed," the data will be in the specified target folder. You can then remove the completed request:

Get-MailboxRestoreRequest -Status Completed | Remove-MailboxRestoreRequest

Common Pitfalls and Troubleshooting

  • Beyond 30 Days: If more than 30 days have passed since the AAD user deletion, the soft-deleted mailbox is permanently purged. Recovery is no longer possible through standard administrative tools. Microsoft Support might have a very limited, last-resort option, but this is not guaranteed and often involves significant data loss.
  • License Requirements: The target user (whether newly created or the original restored user) must have an active Exchange Online license assigned for the mailbox to function or reconnect.
  • AAD Sync Issues: In hybrid environments, ensure Azure AD Connect is healthy and syncing correctly. If you restore an on-premises user, wait for directory synchronization to complete before expecting the cloud mailbox to reconnect.
  • Duplicate Mailboxes: If you create a new user with the same UPN as a previously deleted user, and then try to recover the soft-deleted mailbox, you might encounter conflicts. Always check for soft-deleted mailboxes before creating new users with identical UPNs, or use the Connect-Mailbox method carefully.
  • New-MailboxRestoreRequest Permissions: Ensure the admin account used has the "Mailbox Import Export" role assigned to create mailbox restore requests. You can add this role using New-ManagementRoleAssignment -Role "Mailbox Import Export" -User "admin@yourdomain.com".
  • Conflicting ExchangeGUID: If a new mailbox was provisioned for a recreated user, and you try to connect the old soft-deleted mailbox, you'll get an error. You must delete the newly provisioned empty mailbox first (which will make it soft-deleted itself) or choose the New-MailboxRestoreRequest method.

Back to the knowledge base · Ask the AI assistant