Recovering a Mailbox After a Microsoft 365 User Was Deleted
What happens to Exchange Online mail when HR deletes an account: the deleted-user window, restoring the user vs converting to a shared mailbox, and how Google Workspace compares.
- Deleting a user is not the same as emptying a mailbox — but the clock starts immediately.
- Microsoft 365 typically keeps deleted users restorable for about 30 days unless you purged them.
- Decide restore-user vs shared mailbox vs content search before you click anything.
- Licenses, aliases, and OneDrive are separate objects — mail restore does not automatically mean files.
The offboarding accident
Someone leaves. HR or a helpdesk script deletes the Microsoft 365 user the same day. A week later, legal or a manager needs last quarter’s threads. Whether you can help depends on how the account was removed and whether anyone purged it.
What Microsoft 365 typically does
Soft-deleted users remain in Deleted users for a period that is commonly 30 days. During that window an admin can restore the user, which restores the mailbox, and usually the associated OneDrive, subject to other retention. Hard delete / “Delete permanently” shortens or ends that path.
If a mailbox was converted to a shared mailbox before user deletion, mail can remain without a full user license. That is the preferred offboarding pattern when the team still needs the address: revoke sign-in, convert, then remove the user object later according to policy.
Choose an outcome before you restore
| Need | Better action |
|---|---|
| Person might return; keep identity | Restore the deleted user |
| Team must keep the address and history | Shared mailbox (ideally before delete; restore user first if already deleted, then convert) |
| A few threads for a case | eDiscovery / content search if holds or retention captured them |
| Files in OneDrive | Separate restore / access-grant path — do not assume mail restore includes files forever |
Practical restore sequence
- Search Deleted users. If present, restore. Confirm mailbox appears in Exchange admin.
- Block sign-in until you intend the person to return. Offboarding is not undone just because you needed the mail.
- Grant a manager Full Access or convert to shared mailbox per policy.
- If the user is already past the deleted-user window, check Recoverable Items, litigation holds, and Microsoft 365 retention. Native user restore may be gone even if some mail still exists in compliance tools.
Google Workspace parallel
Admin console → recently deleted users. Restore if still listed. Transfer Drive ownership before deletion is the equivalent of converting a mailbox: do it as policy, not as heroics. Vault may retain mail after the user is gone; restoring a Vault export is not the same as giving the manager an interactive mailbox.
Prevent the next ticket
Write a three-step offboarding: (1) revoke tokens and sign-in, (2) preserve mail and Drive (shared mailbox / ownership transfer / hold), (3) delete the user on a dated calendar after the business signs off. The delete is the last step, not the first.
Related reading
Mailbox dumpsters and recycle windows: Recycle Bin vs Recoverable Items. If the user was purged weeks ago: when native recovery is over.
