Forum Discussion
Exchange online - track deleted mail
I am 365 admin and see quite often people rapport "all my mails are in deleted post - and I have done nothing" or similar
What is the best practice to investigate that. I know in powershell I have made some auditsearches, where it rapports like softdelete, hardelete etc - but is there any more specific way proving that the user actually did in on his own ? -
I know with retention policies it is hard delete - but just wondering what the best practice is like to prove to the user that this is the user. Just write that it is soft deleted and means user have done it, often the user think is not understandable
1 Reply
Audit logs are your best option here, they will clearly indicate who the actor was. And yes, in most cases it's the user itself, or some add-in they allowed. Especially relevant now with AI integrations that helpfully clean up everything in your Inbox :D
