Recovering Deleted Items in the New Exchange Admin Center

Old Exchange Online Admin Center Due for Replacement

You might have noticed that the Exchange Online Admin Center (EAC) is showing its age. Compared to the other workload admin centers in Office 365, EAC is positively creaking at the seams, much like myself.

At the Ignite 2019 conference, Microsoft said that they are working on a new EAC. The new portal is now available in preview and can be launched from the old EAC or through this link. Because it’s a preview, not everything available in the old EAC has been moved across. You can also expect to meet some bugs, especially with new features.

A GUI for Restore Deleted Items

A new addition to the EAC GUI is the ability to restore deleted items for user and shared mailboxes. This capability has existed since 2018, but up to now it’s only been possible with PowerShell. Essentially, what’s now available is a GUI for the Get-RecoverableItems and Restore-RecoverableItems cmdlets to make it possible for administrators who don’t know PowerShell to recover deleted items on behalf of users.

Finding Deleted Items

To use the feature, the account being used must hold the RBAC mailbox import/export role. This role must be assigned to accounts (not even tenant administrators automatically have the role). An administrator account that doesn’t hold the role can select a mailbox, but they won’t be able to choose the Recover deleted items option from the mailbox properties (Figure 1).

Image 1 Expand

A search form (Figure 2) opens to show all the recoverable items available for the chosen mailbox.

Image # Expand

To recover one or more items, select them from the list and click the Recover deleted items button. After a short delay, the items are moved back to their original folder, which you can see in the list.

Scoping Searches for Deleted Items

Busy mailboxes are likely to store tens of thousands of deleted messages. Filters are available to look for items by date range (up to 30 days in the past – see why below), subject, item type (email, appointment, contact, task, and file), and entry ID (a unique identifier for a mailbox item).

Filters are also available to limit items shown to those stored in the three supported locations deleted items can be recovered from:

• Recycling bin: The Deleted Items folder in the mailbox.
• Deletions: The Deletions folder in the Recoverable Items structure. This is where items go after they are removed from the Deleted Items folder. Exchange Online’s Single Item Recovery (SIR) feature means that items deleted from the Deleted Items folder remain in the Deletions folder until the deleted items retention period defined for the mailbox expires (typically 14 days with a maximum of 30 days). SIR exists to ensure that users have a reasonable chance of recovering deleted items if they make a mistake.
• Archived: This does not refer to the archive mailbox (because not every mailbox or shared mailbox is archive-enabled). Instead, it’s the Purges folder under Recoverable Items where deleted items kept due to a retention policy are stored until the retention period set in the policy expires.

Users can restore deleted items themselves from the first two locations. Items are retrieved from Deleted Items by using a client to move them to another folder. Items in the Deletions folder in Recoverable Items are retrieved with the Recover Deleted Items option available in Outlook and OWA.

Using PowerShell to Restore Messages

Because the new GUI is built on top of the Get-RecoverableItems and Restore-RecoverableItems cmdlets, it’s unsurprising that the feature set is limited by the capabilities of the cmdlets. Although most will prefer to use the GUI, reverting to PowerShell is still useful when you need to use a precise date range for a search. EAC offers fixed 7, 14, and 30 days, while you can limit the date range even more with PowerShell. For example:

Get-RecoverableItems -Identity James.Ryan -SourceFolder PurgedItems -FilterStartTime “13-Jun-2020 00:17” -FilterEndTime “13-Jun-2020 00:35”

This is useful when searching through a busy mailbox when even a 7-day search might return hundreds of messages.

Another reason to use PowerShell is if you need to restore items to multiple mailboxes (perhaps after an unfortunate accident when purging items). EAC limits processing to a single mailbox.

New EAC Later in 2020

The new EAC might become generally available later this year. We’ve learned from previous portal transitions that it can take many months and sometimes years before Microsoft is able to move all the functionality from an old portal to its modern equivalent (the SharePoint Online admin center is a good example). At least while the transition happens, you’ll be able to use some new GUI to restore deleted messages if needed.