Here is something interesting around the Office 365 Email category. We often get questions from clients asking about deleted items in Exchange Online. There seems to be some lingering confusion about how long a deleted item persists, who can see it, and when it can be recovered. So, I thought I’d share my take on this – for what it’s worth. Here is the process from beginning to end.
Office 365 Email | Gone?
When a user initially deletes an item from their mailbox, it is moved to the Deleted Items folder. There, users can view it, move it, or respond to it, just like messages in any other folder. There, the message will remain indefinitely by default. There is no Microsoft policy to automatically empty a user’s “deleted items” folder. So, the only real difference between the “deleted items” folder and all other folders is that items do not show up via a full mailbox search (although of course items are found in the search scope explicitly includes the deleted items folder.)
When a user later deletes the item from the “deleted items” folder or empties the “deleted items” folder completely, the item is no longer visible in any default views and will not be found in any standard user searches. However, it can still be viewed and restored in Outlook by the end users by right-clicking the “deleted items” folder and choosing “recover deleted items…”
Single Item Recovery
This is no different from the behavior on-premise that has been available for years. Of course, an administrator can also search for and recover this item on the user’s behalf using single item recovery. At this point, the item is located in what is known as the “deletions” subfolder of the “recoverable items” top-level folder (this was known in prior versions of Exchange as the “dumpster”.)
In Office 365, after 14 days by default, the item is automatically moved from the “deletions” subfolder to the “purges” subfolder (still in the “recoverable items” top-level folder.) This is important because at this point the item can no longer be seen or restored by the end user. However, administrators can still see and recover the item using the Exchange Control Panel or PowerShell. This is the last opportunity to restore the item before it is gone for good – but it doesn’t last long and exactly how long it will last is not certain.
What's an MFA?
Essentially, what happens is the next time the “Managed Folder Assistant” (MFA) processes the user’s mailbox (typically within 7 days or less but it can occur in as little as a few minutes depending upon when the last time the MFA ran), the item is removed from the “purges” subfolder and can no longer be seen or restored by anyone.
Long story short, once an item is deleted from a user’s deleted items folder, you have 14 days to get it back. After that, if you’re lucky, you may be able to restore it on behalf of the user for up to another 7 days. But after that, it’s gone for good. So, that’s maybe 21 days if you’re lucky which is shorter than most admins are comfortable with. As such, I recommend you increase the “deletions” subfolder purge policy to 30 days, thereby extending that maximum potential restore period up to 37 days.
Of course, when a litigation hold is enabled for a mailbox, this behavior is significantly different. The biggest difference is that items are retained in the “purges” subfolder indefinitely, as the MFA does not clear items. This means they can always be found and recovered by your admins. Further, the “versions” subfolder of the “recoverable items” folder is used to retain modified versions of all mailbox items.
Office 365 Email Summary
I have worked with many clients who are tempted to try to use time-bound legal hold as a replacement for journaling, but be aware users cannot restore or view items in the “purges” subfolder. Also, the maximum size of the “recoverable items” folder (comprised of “deletions”, “versions”, and “purges”) is 30 GB with warnings sent to the administrator whenever size exceeds 20GB. This means a lengthy hold could easily consume all available space for a mailbox. It may be suitable for companies with 1 or 2-year retention policies, but beyond that, it may not be a good fit.
Review our case studies and engagements where we helped companies just like yours solve a variety of business needs.
Since 1981, Oakwood has been helping companies of all sizes, across all industries, solve their business problems. We bring world-class consultants to architect, design and deploy technology solutions to move your company forward. Our proven approach guarantees better business outcomes. With flexible engagement options, your project is delivered on-time and on budget. 11,000 satisfied clients can’t be wrong.