Emails disappeared for a user

Question

We use Outlook for O365.
One particular user in the business reported a days emails have disappeared from her Outlook, OWA & mobile device, she then reported a whole years emails have now disappeared.
On further investigation the emails were eventually found in her Outlook ] Deleted items ] recover items recently removed from this folder.
However, we have no idea how the last 12 months emails ended up there?

Answer 1

Hi @Sree

Yes, agree with the suggestions shared by Andy.

You could check if anyone else have access to the user's mailbox ( through full access)

Get-MailboxPermission "username" | Where { ($_.IsInherited -eq $False) -and ($_.AccessRights -like "*FullAccess*") -and -not ($_.User -like "NT AUTHORITYSELF") } | Select Identity, User, AccessRights  

For Retention tags and retention policies in Exchange Online and which policy is applied to the user:

Get-Mailbox "username" | Select RetentionPolicy  

By the way, also check if the user configured autoarchive for her mailbox: Archive older items automatically

They are usually used by: How to automatically remove older emails from Exchange and Outlook
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

You could refer to the official document here to get more information about Recoverable Items folder in Exchange Online

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Either she accidently deleted them, or you have a retention policy that did that - or maybe a delegate if one is defined.
If you think she has no part whatsoever in that and no retention policy is enabled - check for outlook rules....

You can search via the audit logging in the compliance center to hopefully see what moved those:
https://compliance.microsoft.com/auditlogsearch

or mailbox audit logs (if you have owner logging enabled - if she moved those)

https://learn.microsoft.com/en-us/office365/troubleshoot/audit-logs/mailbox-audit-logs