---
sourceDocument: Yokohama Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Recover deleted emails

# Recover deleted emails on the Microsoft Exchange Online service {#ariaid-title1}

* Release version: Yokohama
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

(Optional) As a Microsoft Exchange Administrator, you can recover deleted emails if
your incident remediation requires that you to recover the emails deleted by the workflow of
this integration.

## Before you begin

For more information about how this integration deletes emails, see [Configure the Microsoft Exchange Online integration](https://www.servicenow.com/docs/ZW5OfRNx3w2MUF6LOAenNA "After you’ve installed the application from the ServiceNow Store, configure it to connect to your ServiceNow AI Platform instance. This activation activates the search and delete workflows.").

For more information about the administrative role in the Microsoft
Office 365 product, including information about recovering deleted items in a user
mailbox, see [About the Exchange Online admin role](https://support.office.com/en-us/article/about-the-exchange-online-admin-role-097ae285-c4af-4319-9770-e2559d66e4c8).

Role required: admin, Microsoft Exchange Administrator

## About this task

If you select the Recover Deleted Emails option in the Additional Settings tab during the configuration step, you enable the recovery of deleted emails in your Microsoft Exchange Online tenant. Emails deleted using the delete workflow of this integration are placed in the Deleted Items sub folder of the Recoverable items folder in the mailbox of the user on the Microsoft Exchange Online service. If the user's account is configured in Microsoft Exchange Online tenant so that the user can view the Deleted Items folder, the user can recover these emails by using the Microsoft Outlook service on the web. Alternatively, the Microsoft Exchange Online administrator can recover deleted emails from a Deleted Items folder of a user. See [Recover deleted items or email in Outlook Web
App](https://support.office.com/en-us/article/recover-deleted-items-or-email-in-outlook-web-app-c3d8fc15-eeef-4f1c-81df-e27964b7edd4?ui=en-US&rs=en-US&ad=US) for more information.

Role required: Microsoft Exchange Online
administrator or Microsoft
Global administrator to recover deleted emails.

Role required: sn_si.admin in
the ServiceNow AI Platform to enable the
Recover Deleted Emails option.

Role required: sn_si.analyst in the ServiceNow AI Platform for completing a
successful search for emails and verifying that emails are successfully deleted
prior to recovery.

## Procedure

To enable the email recovery option, follow these steps.

1. Navigate to Security OperationsIntegrationsConfigurations.
2. Locate the Microsoft Exchange Online tile.
3. Click Configure.  
4. In the Microsoft Exchange Online Configuration dialog box that is displayed, click Configure Exchange Online.  
   Figure 1. Configure Exchange Online
5. On the Additional Settings tab under Recover Deleted Emails, select the Enable check box.  
   Figure 2. Recover Deleted Emails
6. Verify any other settings and click Submit.
7. To verify that a search and delete of email messages are successfully completed for the email messages you want to recover, navigate to the security incident that logged the email search and delete workflows.
8. Locate the work notes and verify that the system successfully deleted the messages.  
9. As a Microsoft Exchange Online administrator or Global administrator, log in to your Microsoft Office 365 account.
10. Follow the steps described in [Recover deleted items or email in
    Outlook Web App](https://support.office.com/en-us/article/recover-deleted-items-or-email-in-outlook-web-app-c3d8fc15-eeef-4f1c-81df-e27964b7edd4?ui=en-US&rs=en-US&ad=US) on the Microsoft documentation website.
{#ms-recover-deleted-emails__substeps_bk1_4zb_sgb}
**Previous topic:** [Approve delete email requests for the Microsoft Exchange Online integration](https://www.servicenow.com/docs/KW6zvPY3hBlIpk81g9vOmg "If the approval option is enabled in your ServiceNow AI Platform instance, requests to delete emails are sent to each member of the approval group via email. You select the approval group during the configuration step. Approvals provide your organization with an additional level of control over the deletion of emails.")  
**Next topic:** [Edit security tags for the Microsoft Exchange Online integration](https://www.servicenow.com/docs/LFvX4_UeltzPz0WRetrYFQ "You can edit the names and colors of the security tags in your ServiceNow AI Platform instance for the Microsoft Exchange Online integration. These security tags help you quickly identify when email search either completes or fails. They also identify when requests to delete emails are initiated and when the email items are successfully deleted.")

*[\>]: and then