How Microsoft 365 email deletion and retention actually works
Short answer: When a user deletes an email in Outlook or Outlook on the Web, it moves to Deleted Items (still visible to the user). When the user empties Deleted Items or a retention policy clears it, the email moves to the hidden Recoverable Items folder (also called the Dumpster) for 14 days. Admin tools like Content Search can still find emails there. After 14 days without a hold in place, Microsoft permanently purges the email. Recovery after that window is not possible without Litigation Hold being set before the purge.
Step-by-step M365 email recovery methods
Step 1: Try the user's Recover Deleted Items option first
For emails deleted within the last 14 days, users can recover them directly. In Outlook: Folder menu → Recover Deleted Items. In Outlook on the Web: Settings → View all Outlook settings → General → Recover deleted messages. This shows the Recoverable Items folder without needing admin access. If the email appears here, the user can restore it themselves. This is the quickest path and should always be the first check before escalating to admin-level recovery.
Step 2: Use Content Search in Microsoft Purview for admin-level recovery
If the user cannot find the email via step 1, an M365 administrator can use Content Search. Log into the Microsoft Purview Compliance Portal (compliance.microsoft.com), go to Content Search, create a new search, select the relevant mailbox, and define date/sender/keyword filters. Content Search can locate emails in the Recoverable Items folder including those the user cannot see. Export results as a PST file (a mailbox archive format), then reimport into the user's mailbox using Outlook's Import/Export function.
Step 3: Restore a deleted user account and mailbox (within 30 days)
When a user leaves an organisation and their M365 account is deleted, the mailbox is soft-deleted and retained for 30 days. To restore: M365 Admin Center → Users → Deleted Users → select the account → Restore. Assign a new licence after restoration. Act within 30 days or the mailbox is permanently purged unless Litigation Hold was active on the account. This is the most time-sensitive recovery scenario we encounter with Indian SMEs who offboard staff without planning for mailbox retention.
Step 4: The India angle — M365 plan gaps in Indian SME deployments
Many Indian businesses buy Microsoft 365 Business Basic (the lowest-cost plan) to reduce licence costs. A critical gap: Litigation Hold requires Exchange Online Plan 2 or M365 Business Premium. Basic plan users cannot enable Litigation Hold. This means once an email is purged beyond the 14-day window, or a user account is deleted for more than 30 days, the data is gone with no recovery path. For any business where email records have compliance or legal value (contracts, invoices, HR records), upgrading to a plan with Litigation Hold is not optional. The cost difference between Business Basic and Business Premium is roughly ₹400–₹600 per user per month.
When to call a recovery service (and what it costs in India)
When DIY ends
Cloud email recovery is an administrative task, not a hardware repair. Stop and consult an IT professional if: the 30-day window for deleted accounts has passed without Litigation Hold, you are not an M365 Global Admin and cannot access the Purview Compliance Portal, or the lost emails were in a shared mailbox rather than a personal mailbox. For data recovery from a physical laptop (PST files on local storage, Outlook data files), see our data recovery service.
Typical cost in India
M365 admin recovery assistance (Content Search, PST export, reimport): ₹2,000–₹6,000 as a professional service engagement. Litigation Hold setup and compliance consulting: ₹5,000–₹15,000 for initial configuration. Also see our OneDrive ransomware rollback guide for a related M365 data recovery scenario.
A note from the LRW Engineer Team
The number of Indian SMEs we encounter that have lost important email due to an accidental account deletion — often when HR offboards an employee without informing the IT admin — is surprisingly high. The fix is a simple policy: when offboarding an employee, convert their mailbox to a shared mailbox first (no licence required after conversion) so it stays accessible indefinitely without paying for a full user licence. This takes two minutes and prevents a 30-day panic.