Item-level restore — Exchange, AD, SharePoint, file
Selective restore of a deleted mailbox item, AD object, file or SharePoint document — without restoring the whole system.
Indicators
- User reports deleted email past Recoverable Items window
- AD object accidentally deleted (user, group, OU)
- SharePoint document or list item gone, not in Recycle Bin
- Specific file deleted from share, needed by user
Likely causes
- Not applicable — this is a procedure entry.
Diagnostic steps
-
Identify the item: name, last-known-good time, owning user / location
-
Check native recoverable channels first — Recoverable Items in Exchange, AD Recycle Bin, SharePoint stage-1 and stage-2 Recycle Bins
-
If beyond native: open backup tool's item-level / explorer feature (Veeam Explorer for Exchange / AD / SharePoint)
-
Mount the most recent good restore point pre-deletion — restore in place if possible, or to alternate location to avoid overwriting
-
For AD: import-back via Veeam Explorer for AD / authoritative restore if widespread, or manual recreation if a single object
-
Document the restore — when, what, who, why, tool
Resolution path
- Try native first (free, fastest)
- Step up to backup-vendor explorer if needed
- Restore to alternate location, validate, then commit
- Document the restore action
Prevention
- M365 Backup with adequate retention (native is short)
- AD Recycle Bin enabled (it is not by default in older domains)
- User education: where is data, what's the deletion model
- Retention policies aligned to legal / business requirements
Tools
- Exchange Recoverable Items (admin centre)
- AD Recycle Bin (Get-ADObject -IncludeDeletedObjects)
- SharePoint Recycle Bin (stage 1 + 2)
- Veeam Explorer for Exchange / AD / SharePoint
- M365 Backup tools (Veeam, AvePoint, Datto SaaS Protection)
References
- Microsoft Learn — Recover deleted items in Exchange Online
- Microsoft Learn — Active Directory Recycle Bin
- Veeam — Explorer for Exchange / AD / SharePoint user guides