How to Find a Missing Exchange Online Email

In your role as a Microsoft 365 admin, you may sometimes have a user who knows that an email was sent to him but cannot find the email in his inbox. The most likely culprit is an inbox rule that was made and forgotten and that forwarded the missing Exchange Online email to a hidden folder. The problem is that you cannot see the hidden folders and you cannot see the inbox rules or the components of the rule to see where the email was sent.

The user knows that the email was sent within 7 days, and he gives you the subject line. You will have to use the subject line to use the e-discovery feature in the Microsoft 365 admin portal. This should tell if the email was received by the user, however this method is not always reliable. If the message is in the user mailbox, then you will have to make yourself the owner of the mailbox and go check for it.

If you cannot find it, it must be in a hidden folder.

An Exchange Online hidden folder is a folder that is invisible to the user. They include folders such as Recoverable Items, SubstrateHolds, Deletions, DiscoveryHolds, Purges, Versions and more. An IT admin can gain the ability to see these folders by using PowerShell or a PowerShell alternative.

You have a few options for finding a missing email in a hidden folder.

PowerShell can help you retrieve this information provided you are willing to take the time required to write a script with specific parameters. But the biggest task will be to figure out how to organize the exported results so you can find that email.

For example, you can use the Get-RecoverableItems cmdlet to search for emails in three folders: Deleted Items, Purges, and Deletions.

More details on the parameters for Get-RecoverableItems can be found on this page.

With sapio365, you simply request a search for all Exchange Online emails that had been received within the last 7 days with or without the specified subject line.

You should make sure that the search specifies all folders, including the recoverable items folder and any others that are invisible to the user.

Once you have located the email, you can copy this email back into the user’s inbox so he can read and reply to it.

Now that you have found the email, the cause of the email going missing needs to be addressed. More than likely, it was a problem with inbox rules that either conflict or were forgotten. Even as a global admin, to see a user’s inbox rules requires that you sign in as that user. The most common way to solve this challenge is to use PowerShell, but again you have options.

The first step is to find a PowerShell script that provides you with a list of all the rules, however there could be hundreds of mailbox rules in place, and you would need to sift through all of them.

For example, you can use this cmdlet to retrieve the list of inbox rules for a single mailbox:
Get-InboxRule -Mailbox <-id or username->

More details on the Get-InboxRule cmdlet and its parameters can be found on this page.

You would also need to examine all the components of the rules to see which one applied to the missing email.

An easier option is to use a PowerShell alternative like sapio365 to get a view of all the mailbox rules for that user, presented in a logical and easy-to-understand display.

In addition to the inbox rules, you can examine the rules’ components to find the rule that caused the email to go missing.

In this example, the subject line included the word “Free”, and a rule had been made for any email with the word “free” to be deleted.

Now that you have found the rule, you can now deactivate the rule and inform the user. You can read more about Exchange Online inbox rules here.

Using PowerShell to find a missing email involves multiple scripts and is a complex process. As with many PowerShell scripts, errors can easily occur. A PowerShell alternative like sapio365 is an easy choice for Microsoft 365 Office IT admins who can’t write a PowerShell script and don’t want to search for one. If you do write one, you need to be confident in your abilities. Using sapio365 to accomplish IT tasks can save you hours of time every day and there isn’t much that sapio365 can’t do. Discover how using sapio365 to handle typical Microsoft 365 administration can save you hours of time every single day.