dear friends

Happy New year to you !!

We are testing an email retention policy in O365 that will delete the email after “one year” based on “when they are created.”

I am trying to find the answer of below questions:

  1. Post the deletion due to retention, will those emails go to “recover deleted items?”
  2. Post the deletion due to retention, will those emails be permanently deleted that means, they won’t be shown under “recover deleted items”?
  3. Post the deletion due to retention, can an admin recover those emails using e-discovery (if the user is not on any kind of hold)?

I thank you in advance, I hope I can get some help.

4 Spice ups

I hope the below helps.

  1. No, emails deleted due to a retention policy will not go to the “Recoverable Items” folder. They are permanently deleted and bypass the “Deleted Items” and “Recoverable Items” folders.
  2. Yes, emails deleted by a retention policy are permanently deleted and will not appear in the “Recoverable Items” folder.
  3. No, once emails are permanently deleted by a retention policy and the user is not on any kind of hold (like Litigation Hold or In-Place Hold), they cannot be recovered using eDiscovery.

Short version, No, Yes, No.

You should be backing up your emails anyway, so any recoveries will have to come from that.

1 Spice up

That’s not entirely correct, but we need to clarify things first. The “Recover deleted items” container we can access via Outlook corresponds to the “Deletions” folder in the Recoverable Items subtree. Items can end up there for a variety of reasons, including (soft) retention processing, but in general this folder is just an intermediate step.

On the other hand, we have the “Purges” folder. Even if the policy/tag is set to “permanently” delete, the items will be moved to the Purges folder within the Recoverable Items subtree, where they will be kept for the duration of the Single-item recovery period (14-30 days), or for the duration of any holds applied on the mailbox. An admin can recover such items for the duration of the SIR/hold period. Details for example here: Recoverable Items folder in Exchange Online | Microsoft Learn

I’m generalizing a bit here, as apart from the Purges folder, some other folders play a similar role for various hold scenarios. But the short version is admin can still recover items as long as they are kept in said folders, that is for the duration of the SIR window or any holds applicable.

1.Depending on your retention policy, emails are permanently deleted when they expire and do not go to Recover Deleted Items.
2.It will be permanently deleted.


3.

You can refer to this link for details: Recover deleted messages in a user’s mailbox in Exchange Online | Microsoft Learn

thank you so much @Brucejyc

thank you @michev

If my answer is helpful to you, please mark it as the answer so that other users can refer to it. Thank you for your support and understanding.

1 Spice up

@michev @Brucejyc

A follow up question:
I was doing a content search in MS purview. I see that I can see my 2022 emails as well; despite of having the retention policy that deletes the emails after one year.

Can you help me understand this behavior? I mean why do an admin see older emails? where in the emails should not be found after 1 year.

if you can share a document too explaining this, that would be great.

Thank you again guys

I gave you the explanation above: even for retention policies with “hard delete” action, items will still be preserved in the Recoverable Items subtree, where they will be kept for the duration of the Single-item recovery period (14-30 days), or for the duration of any holds applied on the mailbox. The fact that the end user cannot access the items in Outlook does not mean that admin tools (such as Content search) cannot access them either, as long as they are kept due to hold or SIR.

hello @michev

Thank you for the response. The mailbox is not on hold 100%.