Share via

How to Recover a non-permanently deleted email from M365 Quarantine

Daniel Needemyer 40 Reputation points
2026-06-22T17:42:33.22+00:00

I have a user who had an incoming email that ended up in the Quarantine. I regularly clean the Quarantine, using a non-permanent deletion. From what I understand, I should be able to retrieve the email, but I can find the appropriate instructions on how to do this.

Exchange Online
Exchange Online

A cloud-based service included in Microsoft 365, delivering scalable messaging and collaboration features with simplified management and automatic updates.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Hin-V 16,065 Reputation points Microsoft External Staff Moderator
    2026-06-22T23:25:39.5066667+00:00

    Hi @Daniel Needemyer

    Thank you for sharing your concerns. 

    Currently, I have not identified any reliable method, whether through the UI, PowerShell, or related documentation, to recover the deleted message in the Quarantine. Based on the available documentation, it only indicates that a message is no longer recoverable once it has been permanently deleted, and it does not provide any additional guidance for recovering soft-deleted messages from Quarantine. 

     image

    You can refer via: Manage quarantined messages and files as an admin - Microsoft Defender for Office 365 | Microsoft L… 

    To further investigate and resolve this issue, Microsoft Support will need to be engaged. A technical support engineer can conduct a remote session to examine the situation, validate backend configurations, and run any necessary synchronization or diagnostic tools. If needed, the issue can also be escalated to a specialized team for more in-depth analysis. 

    Reference: Get support - Microsoft 365 admin | Microsoft Learn 

    Note: To create a support ticket, you need to have Microsoft 365 admin privileges and if you aren’t admin of your organization, please contact the admin of creating a new ticket. 

    Apologies for redirecting you to the related development team support. As moderator in this community, I do not have access to your specific tenant configuration, and my testing environment is limited. Therefore, my guidance is based on available Microsoft documentation and resources. That said, I’ll do my best to provide additional insight where possible.  

    If you have any additional concerns, feel free to comment below. I would be more than happy to assist. 

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.  

    Was this answer helpful?

  2. AI answer

    2026-06-22T17:42:56.9266667+00:00

    Non-permanently deleted (that is, still-quarantined and not yet expired) messages in Microsoft 365 can be recovered only while they remain in quarantine. Once a message is permanently deleted or expires from quarantine, it cannot be recovered.

    Use these checks and steps:

    1. Verify the message is still in quarantine and not expired
      • In the Microsoft Defender portal at https://security.microsoft.com, go to:
        • Email & collaboration > Review > Quarantine > Email tab.
      • Use Filter and the Search box (by sender address or full subject) to locate the message.
      • In the details flyout, check Expires. If the message has already expired, it is permanently deleted and cannot be recovered.
    2. If the message is still in quarantine (user self-release allowed)
      • Select the message.
      • Either:
        • On the Email tab: select Release (check-mark icon), or
        • In the details flyout: select Release email.
      • In Release message to your Inbox, optionally select Report message as having no threats, then select Release message.
      • The message is re-delivered to the mailbox (with a new delivery timestamp). The Release status becomes Released.
    3. If the message was deleted from quarantine (non-permanent vs permanent)
      • When a user or admin deletes a message from quarantine using Delete messages / Delete from quarantine and confirms Permanently delete the message from quarantine, the message is not recoverable.
      • Messages also automatically expire after the retention period shown in Expires. When they expire, they are permanently deleted and cannot be recovered.
      • To confirm who deleted a quarantined message, an admin can:
        1. Go to Audit at https://security.microsoft.com/auditlogsearch (or via the Microsoft Purview portal).
        2. Run an audit search with activity Deleted Quarantine message and the appropriate date range and user filter.
    4. If the message is missing from quarantine
      • Check whether it has expired or been deleted as above.
      • If it expired, it cannot be recovered.
      • If neither applies and messages appear to be missing, open a support case within 7 days of the affected messages for the best chance of investigation.

    In summary: recovery is only possible by releasing the message while it is still present in quarantine and before it is permanently deleted or expires. There is no restore path for permanently deleted or expired quarantined messages.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.