Why eDiscovery Export Doesn’t Show Deleted Emails in Exchange Online (No Hold / Default Retention)
🔍 The Symptoms / Error Message
⚠️ What You May Experience
“Expected emails are not appearing in eDiscovery search or export results.”
“Deleted emails older than X days are missing from Recoverable Items and cannot be exported.”
🧠 Root Cause
💡 This Behaviour Is By Design
This behaviour is by design in Exchange Online when no compliance retention is configured. Key factors:
- The mailbox is assigned the default Messaging Records Management (MRM) policy
- No Litigation Hold, eDiscovery Hold, or Retention Policy/Label is applied
- Exchange Online enforces a standard deletion lifecycle
| Item State | Retention Behaviour |
|---|---|
| Deleted Items folder | Permanently deleted by user or retention cleanup |
| Recoverable Items → Deletions | Retained for 14 days (default) |
| Recoverable Items → Purges | Retained up to 14–30 days (configurable) |
| After retention expiry | Permanently deleted from mailbox store |
⚠️ Once Items Move Beyond Recoverable Items → Purges and Retention Expires
- ❌ Data is not recoverable
- ❌ Data is not indexed by eDiscovery
- ❌ Data is not included in export results
This is expected behaviour for mailboxes without compliance preservation, and for users licensed with Microsoft 365 Business Basic (no advanced retention by default).
🛠️ Step-by-Step Resolution
Verify Mailbox Retention and Hold Status
Check the mailbox’s current hold and retention configuration before investigating further.
Connect-ExchangeOnline # Check mailbox configuration Get-Mailbox -Identity "user@yourdomain.com" | Select DisplayName,LitigationHoldEnabled,RetentionPolicy,InPlaceHolds # Check Recoverable Items retention Get-Mailbox -Identity "user@yourdomain.com" | Select RetainDeletedItemsFor
Confirm Recoverable Items Folder Status
Check whether the Purges folder still contains data or has already been emptied by retention cleanup.
Get-MailboxFolderStatistics -Identity "user@yourdomain.com" -FolderScope RecoverableItems | Select Name,ItemsInFolder,FolderSize
⚠️ Interpreting the Result
If the Purges folder is empty, it indicates items were already permanently deleted and are not recoverable through any means.
Enable Litigation Hold (Future Protection)
This protects against future data loss — it does not recover what has already been purged.
⚠️ Important
This step does not recover previously deleted data — it only prevents future data loss going forward.
Set-Mailbox -Identity "user@yourdomain.com" -LitigationHoldEnabled $true # Optional: Set hold duration (in days) Set-Mailbox -Identity "user@yourdomain.com" -LitigationHoldDuration 3650
Configure a Retention Policy (Recommended for Business Environments)
Rather than relying on the default MRM policy, implement a structured retention policy through Microsoft Purview.
✅ GUI Method — Microsoft Purview Compliance Portal
- Go to Microsoft Purview Compliance Portal
- Navigate to: Data lifecycle management → Retention Policies
- Create a policy with:
- Scope: Exchange Online mailboxes
- Action: Retain and/or delete
- Duration: Based on business requirement (e.g., 1 year, 7 years)
Validate eDiscovery Search Scope
Confirm the search parameters are correctly configured before assuming data is missing.
✅ Ensure
- The correct mailbox is included
- The correct date range is configured
- Recoverable Items is included in advanced search settings
⚠️ Important Limitation
🔴 Data Recovery Limitation
Once emails are permanently deleted after the retention window:
- ❌ They are not recoverable by Microsoft Support
- ❌ They are not stored anywhere in the tenant
- ❌ They are not accessible via eDiscovery or backup APIs
💡 Best Practices & Recommendations
- Always enable Litigation Hold or Retention Policies for critical users
- Extend the Deleted Item Retention Period (up to 30 days minimum)
- For compliance-heavy environments, use Microsoft Purview retention labels
- Avoid relying solely on default MRM policies for business-critical mailboxes
✅ Key Takeaway
This scenario aligns with expected Microsoft 365 behaviour — especially in environments where no compliance retention is enforced. For ongoing compliance cases (including domain spam flags or mailbox investigations), proactively enabling retention policies is critical to ensure evidence availability during audits or eDiscovery requests.
📚 References & Further Reading
- 🔗 Retention policies in Microsoft 365 — Microsoft Learn
- 🔗 Recoverable Items folder in Exchange Online — Microsoft Learn
- 🔗 Microsoft Purview eDiscovery — Microsoft Learn