recover deleted data in Exchange Online and SharePoint Online

Recovering deleted data in Exchange Online and SharePoint Online is essential for maintaining business continuity and compliance in any organization utilizing Microsoft 365 services. The ability to restore lost information can be crucial, especially when accidental deletions occur or there is a need to recover data for legal or auditing purposes.

Exchange Online Data Recovery

Exchange Online provides several methods for recovering deleted items, including the Recoverable Items folder and retention policies.

Recoverable Items Folder

Every mailbox in Exchange Online has a Recoverable Items folder, a hidden folder meant to protect from accidental deletion. When a user deletes an item (email, calendar entry, etc.), it’s moved here. The default retention period for items in this folder is 14 days, but it can be extended to a maximum of 30 days.

To recover items from the Recoverable Items folder:

1. In Outlook, navigate to the folder list and select the “Deleted Items” folder.
2. Click “Recover Deleted Items From Server” to open the Recover Deleted Items tool.
3. Select the items to recover and click “Restore.”

Administrators can also use the Search-Mailbox PowerShell cmdlet to search and recover items.

Retention Policies

Organizations might configure custom retention policies in Exchange Online to retain data for longer periods. For example, a retention policy could be set to retain deleted emails for one year. If items are purged from the Recoverable Items folder, they might still be retained under such a policy and can be recoverable through eDiscovery.

Example of recovery through a retention policy involves:

1. Admins opening the Security & Compliance Center.
2. Navigating to the “eDiscovery” section.
3. Creating a new eDiscovery case and searching for the deleted content.
4. Exporting the content found or directly restoring it to the user’s mailbox.

SharePoint Online Data Recovery

Like Exchange Online, SharePoint Online provides mechanisms to recover data such as the Recycle Bin and retention policies within retention labels and retention policies.

Recycle Bins

SharePoint Online has two stages of Recycle Bins: the site Recycle Bin and the Site Collection Recycle Bin.

1. Site Recycle Bin: When a user deletes an item, it goes into the site Recycle Bin, where it is kept for 93 days.
2. Site Collection Recycle Bin: If an item is deleted from the site Recycle Bin, it moves to the Site Collection Recycle Bin, where it remains for the remainder of the 93-day period.

To recover items from the Recycle Bin:

1. Navigate to the SharePoint site.
2. Click on the Recycle Bin link in the Quick Launch bar or from the Site Contents page.
3. Select the items to restore and click “Restore.”

Retention Policies and Labels

Retention policies in SharePoint Online are designed to retain content for a specified period for compliance purposes. A retention policy or label, once applied to content, will preserve it even if a user attempts to delete it.

If a retention policy is in place, data can be recovered from the Preservation Hold library, where the items are kept until the retention period is over.

To recover from a Preservation Hold library:

1. Navigate to the SharePoint site.
2. Go to the Preservation Hold library (only visible to admins).
3. Select the items to restore and move them back to their original location.

Comparison Table for Recovery Options

It’s critical for organizations to understand these options and effectively configure their Microsoft 365 environment to meet their data recovery needs. Properly configured retention policies can provide a long-term safety net, while the immediate recovery from the Recoverable Items folder and Recycle Bin can quicken day-to-day operational recovery. It’s recommended that admins familiarize themselves with using PowerShell for advanced recovery scenarios and the eDiscovery process for complex retrievals and legal compliance. Regular review and testing of these recovery processes is one of the best practices in ensuring data integrity and availability in Microsoft 365.