Restore Active User Mailbox / Restore Contacts

[Jeff Harlow]

Need a way to restore an active users mailbox that is in Exchange Online. In short, user was compromised and all of their contacts were deleted. They are not in deleted items or recovery items even though the mailbox has retention tags enabled.  I attempted to use eDiscovery to recover the items but eDiscovery is not paying nice when it comes to restoring Contacts.  Exported the PST files (multiple) from eDiscovery and after review, it only appears to have a percentage of the person's contacts.  

Followed the process of restoring a mailbox but it only appears to be available if the mailbox in a whole was deleted (soft/hard delete). How does one go about restoring a mailbox when the user is still active in the system? 

If there is a better way to restore the contacts, that would be great as well. Thank you. 

[#2]

Retention tags in Exchange do not help with data recovery, they are used to delete/move data. Still, the deleted contacts should be recoverable for up to 14 days after the incident, 30 if you have increased the Single-Item recovery window to the maximum value. If you are not able to find them in the Deleted Items/Recover deleted items container, then eDiscovery is your only option. You can search for "kind:contacts" to include all contacts.

Again, this will only work for a limited time if the contacts have been deleted, unless you have put the mailbox on hold.

[#3]

Agree with Vasil and had the same issue with my mailbox. However, the native capabilities are very limited and the eDiscovery was also not helping in the end. That was bad luck :( We now use a 3rd party tool to backup our entire O365 environment and didn't have such scenario again. Sorry we cannot help you further with your inquiry.

[#4]

What solution are you using, if I might ask? I have learned from this situation not to depend on MS for recovery of data in their cloud.  

[#5]

Hi Jeff,

you can have a look here:

https://www.avepoint.com/products/office-365-services/office-365-backup/

All what you need ;)

Hope this helps and best regards

Rob