Commands › Exchange Online

Get-RecoverableItems

Exchange Online ExchangeOnlineManagement Get-*

Use the Get-RecoverableItems items cmdlet to view deleted items in mailboxes. After you find the deleted items, you use the Restore-RecoverableItems cmdlet to restore them. To use this cmdlet, you need to add the Mailbox Import Export role to a role group (for example, to the Organization Management role group). For more information, see Add a role to a role group.

Quick start script

# Get-RecoverableItems — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Get-RecoverableItems | Format-List

# 3. Export for evidence / drift tracking
Get-RecoverableItems | Export-Clixml .\RecoverableItems-$(Get-Date -Format yyyyMMdd).xml

Syntax — 2 parameter sets

OnPremises

Get-RecoverableItems -Identity <GeneralMailboxOrMailUserIdParameter>
 [-EntryID <String>]
 [-FilterEndTime <DateTime>]
 [-FilterItemType <String>]
 [-FilterStartTime <DateTime>]
 [-LastParentFolderID <String>]
 [-ResultSize <Unlimited>]
 [-SourceFolder <RecoverableItemsFolderType>]
 [-SubjectContains <String>]
 [<CommonParameters>]

Cloud

Get-RecoverableItems -Identity <GeneralMailboxOrMailUserIdParameter[]>
 [-EntryID <String>]
 [-FilterEndTime <DateTime>]
 [-FilterItemType <String>]
 [-FilterStartTime <DateTime>]
 [-LastParentFolderID <String>]
 [-MaxParallelSize <Int32>]
 [-PolicyTag <String[]>]
 [-ResultSize <Unlimited>]
 [-SkipCount <Int32>]
 [-SourceFolder <RecoverableItemsFolderType>]
 [-SubjectContains <String>]
 [<CommonParameters>]

Parameters (12)

ParameterTypeRequiredWhat it controls
-Identity GeneralMailboxOrMailUserIdParameter The Identity parameter specifies the mailbox that contains the deleted items that you want to view. You can use any value that uniquely identifies the mailbox. For example:
-EntryID String The EntryID parameter specifies the deleted item that you want to restore. The EntryID value for the deleted item is unique in the mailbox.
-FilterEndTime DateTime The FilterEndTime specifies the end date/time of the date range. This parameter uses the LastModifiedTime value of the item.
-FilterItemType String The FilterItemType parameter filters the results by the specified MessageClass (ItemClass) property value of the deleted item. For example:
-FilterStartTime DateTime The FilterStartTime specifies the start date/time of the date range. This parameter uses the LastModifiedTime value of the item.
-LastParentFolderID String The LastParentFolderID parameter specifies the FolderID value of the item before it was deleted. For example, 53B93149989CA54DBC9702AE619B9CCA000062CE9397.
-MaxParallelSize Int32 This parameter is available only in the cloud-based service.
-PolicyTag String[] This parameter is available only in the cloud-based service.
-ResultSize Unlimited The ResultSize parameter specifies the maximum number of results to return. If you want to return all requests that match the query, use unlimited for the value of this parameter. The default value is 1000.
-SkipCount Int32 This parameter is available only in the cloud-based service.
-SourceFolder RecoverableItemsFolderType The SourceFolder parameter specifies where to search for deleted items in the mailbox. Valid values are:
-SubjectContains String The SubjectContains parameter filters the items by the specified text value in the Subject field. If the value contains spaces, enclose the value in quotation marks (").

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.