Shared mailbox messages going to recoverable deleted items

[JustAnotherITGuy]

Hi!

Trying to solve an issue that's plagued me for a couple weeks. We have a shared mailbox hosted in Exchange Online that receives customer orders. We're discovering that many orders are somehow landing in the recoverable items section of deleted items and we've yet to find a root cause. Things I've tried:

1. Disable, then deleted, all mailbox-level rules on the shared mailbox.

2. Tried to get audit logs from protection.office.com - no results available.

3. Eventually stumbled on this article which lets me export logs to a CSV.

https://support.microsoft.com/en-us/help/4021960/how-to-use-mailbox-audit-logs-in-office-365

However the logs are somewhat inconclusive. I see some actions like "SoftDelete" from users (which I think would not move the email to recoverable deleted items). I also see "MoveToDeletedItems" and "HardDelete". However there's only a handful of hard deletes - not enough to account for the hundreds of emails showing in recoverable deleted items.

4. Reset all users passwords.

5. Had their supervisor remind them no emails should be deleted, only moved to a folder called "Completed". Multiple users insist they understand this protocol and are following it.

6. Checked several suspect users in the audit log for Outlook issues, rules, ignore, or other reasons that might be causing it. Rebuilt a suspect user's Outlook profile.

7. Ran Get-InboxRule to see if there were any additional rules

8. Ran outlook.exe /cleanconvongoingactions to remove any ignores

9. Remove all mailbox permissions except for system ones (e.g. NT Authority\SELF, NAMPRD02\Exchange Users, etc.). Re-add to try to identify which users are causing deletes. As we've slowly re-added users we saw deletes stop for a while and thought we had identified a specific user, but today confirmed that is not the case - there's no specific user that appears to be the cause. 

Help? Any ideas? 

[#2]

Mailbox Auditing is the correct method to troubleshoot this, but I'd suggest you also check for any retention policies applied on the mailbox.

Also, Hard-delete corresponds to the message being Purged (moved to the Purges folder is SIR/hold is configured for the mailbox), not to moving messages to the Recoverable Items folder. That last one is still a soft-delete operation. Make sure all of these operations are actually being audited.

[#3]

Did you find a resolution for this? I have a very similar issue giving me grey hairs!

[#4]

I have a similar issue as well. I have a user moving an email from the shared mailbox's Inbox to a sub folder in the shared mailbox by dragging and dropping. It shows up in the recoverable deleted items and in the audit log as a soft-delete.

[#5]

Hi Guys, there's a registry change I found which fixed for me: 

If the user has at least author rights to the shared mailbox's Deleted Items folder, the deleted items can go into the shared mailbox's deleted items folder. You (or the administrator) need to add this key to the registry.

Outlook 2016 and Outlook 2019

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Options\General
DWORD: DelegateWastebasketStyle
Value: 4 (use shared mailbox's Deleted items)
8 (use the default (or user's) deleted items folder)

@EEH18 

I can't see this working however with OWA or o365 online

[#6]

I am having the exact same issue with a user in our environment, accessing Shared Mailbox via Outlook Desktop client and randomly when dragging and dropping an email it will sometimes go into the Deleted Items and sometimes as you say go into the Recoverable Deleted Items.

Did you ever find a resolution to this? I'm basically at the point of raising a call with MS but because the issue is so intermittent troubleshooting is a pain in itself as I can't seem to replicate the issue. Very odd behaviour...

Thanks

[#7]

Anyone have success with this? We are having a similar issue for only 1 shared mailbox.