deleted or automatically redirected to the spam folder

it is possible to identify whether an email was deleted or automatically redirected to the spam (junk) folder, though the visibility depends on how your organization’s auditing and mailbox settings are configured.

If you want to see whether a message was deleted, you can use the Microsoft Purview Audit Log (Unified Audit Log). It captures user-level actions such as SoftDelete, HardDelete, and MoveToDeletedItems. These events show when a message was deleted manually by a user or by a system action such as retention policy cleanup. For shared or delegate mailboxes, make sure mailbox auditing is enabled so that these events are logged for all users accessing that mailbox.

If you suspect the message was automatically redirected to the Junk Email (Spam) folder, you can review Message Trace or Threat Explorer (Email & Collaboration in Microsoft Defender). Both tools record the delivery location and detection action fields. For example, the trace may show DeliveredToJunkFolder or Quarantined if Microsoft’s filtering systems identified the message as spam or phishing. In addition, if the user has client-side rules or Outlook Safe Lists, you can check Mailbox Rule Audit Logs to confirm if the email was redirected automatically by a user-created rule.

the deleted messages can be traced through audit logs, and emails redirected to spam can be verified through Message Trace or Threat Explorer reports. Combining both sources gives you a full picture of what happened to a message. Please hit like if you like the solution.