Quick guide on recovering a delete item in Exchange online

1. Sign in to the Microsoft 365 admin center using your admin credentials.
2. Navigate to the Exchange admin center.
3. In the Exchange admin center, go to the recipients tab and select mailboxes.
4. Find the user's mailbox that contains the deleted email item and click on it.
5. Under the mailbox properties section, select the "..." option and then select "Recover deleted items".
6. A dialog box will appear showing the deleted items that can be recovered. Select the email item that needs to be recovered and click on "Recover".
7. A message will appear asking for confirmation to recover the item. Click on "OK" to recover the item.
8. The recovered item will be restored to the original folder in the user's mailbox.

Note: The ability to recover deleted items may depend on your organization's retention policies and the length of time since the item was deleted. If the item was permanently deleted, it may not be recoverable.

#Powershell

1. Connect to Exchange Online PowerShell using your admin credentials.
2. Run the following command to get a list of all the mailboxes that have deleted items:
   
   Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Get-MailboxFolderStatistics -FolderScope RecoverableItems | Where-Object {$_.DeletedItemCount -gt 0} | Select-Object Identity
   
   
3. From the list generated in step 2, identify the mailbox containing the deleted email item that you want to recover.
4. Run the following command to recover the deleted email item:
   
   New-MailboxRestoreRequest -SourceMailbox "MailboxName" -SourceStoreMailbox "MailboxName" -TargetFolder "RecoveredMessages" -ContentFilter {(Received -lt 'DateOfDeletion')} -AllowLegacyDNMismatch
   
   Replace "MailboxName" with the name of the mailbox that you want to recover the deleted email item from. Replace "DateOfDeletion" with the date the email item was deleted.
   
   
5. After the command completes, the recovered email item will be located in the "RecoveredMessages" folder of the mailbox that was specified in the command.

Recover deleted messages in a user's mailbox in Exchange Online | Microsoft Learn

Connect to Exchange Online PowerShell | Microsoft Learn

Recovering deleted items in Exchange online GUI permissions

By default Exchange online has single item recovery enabled, but as a Global admin you do not normally have permission to do a recovery for a users mailbox.

You need to add the role from the left hand side, select "Roles" then "Admin Roles" followed by "Add role group"

Give the group a name and assign the following permission "Mailbox Import Export" and add the admins you wish to do the recovery.

Then give it an hour or so for it to take affect 

PowerShell Exchange 365 Output Archive sizes and Quota

$table = New-Object System.Data.DataTable
$table.Columns.Add("Name", "System.String")
$table.Columns.add("Archive_Size", "System.String")
$table.Columns.add("Archive_Quoted", "System.String")
$table.Columns.add("AutoExpand", "System.String")

Foreach ($i in (Get-Mailbox -Archive | sort Name)) {
    $archive = $i | Get-MailboxStatistics -Archive
    $row = $table.NewRow()
    $row.Name = $i.Name
    $row.Archive_Quoted = $i.ArchiveQuota
    $row.Archive_Size = $archive.TotalItemSize
    $row.AutoExpand = $i.AutoExpandingArchiveEnabled
    $table.rows.add($row)
}

cls
$table | Format-Table

Exclaimer Cloud and Microsoft 365 - Internal Emails sent to distribution groups send external to come back in again

An issue with Exclaimer Cloud and Microsoft 365 where an internal email sent to an internal distribution group ends up getting sent via the MX records.

This can lead to internal emails hitting external spam filters and getting blocked.

The fix is to set ReportToOriginator to TRUE.  this can be done via the AD users and groups but if they are a number of groups PowerShell the way to go.

Get-ADGroup -Filter * | where GroupCategory -eq Distribution | Set-ADGroup -Replace @{ReportToOriginator=$true}

Messages sent to distribution groups are identified as spam or delivered to the recipient's junk folder – Knowledge Base (exclaimer.com)

Messages sent to distribution groups do not have a signature applied – Knowledge Base (exclaimer.com)

Enable Microsoft 365 Message Encryption

This is a great feature for sending secure emails and is easy to set up.  First the users need to use the feature will need one of the following:

• Azure Information Protection for Office 365
• Azure Information Protection Premium P1
• Azure Information Protection Premium P2

Once you have the right subscription you can enable the option via PowerShell with the following commands.

Import-Module ExchangeOnlineManagement

Import-Module AIPService

Connect-AipService

Connect-ExchangeOnline -UserPrincipalName <Admin Account>

Set-IRMConfiguration -AzureRMSLicensingEnabled $True

#Confirm Not NULL

$RDM = Get-AadrmConfiguration

$Uri = $RDM.LicensingIntranetDistributionPointUrl

Set-IRMConfiguration -LicensingLocation $Uri

Set-IRMConfiguration -InternalLicensingEnabled $true

Once its all set up you can confirm its working with the below Powershell command

Test-IRMConfiguration -Sender <Email address>

Once this is done the option will appear in OWA and Outlook can install the Azure rights management software but this can take a few hours.  you can also make a mail flow in Exchange 365 admin to encrypt on a keyword.  

Pricing – Information Protection | Microsoft Azure

Message Encryption - Microsoft 365 Compliance | Microsoft Docs

Set up new Message Encryption capabilities - Microsoft 365 Compliance | Microsoft Docs

Configure and manage templates for Azure Information Protection - AIP | Microsoft Docs

 

Microsoft Support and Recovery Assistant

 

Microsoft Support and recovery assistant is a nice tool to help with Office applications, Microsoft 365, and Outlook issues.

Its a nice first step if you are having an issue with a device or an account.

https://support.microsoft.com/en-us/office/about-the-microsoft-support-and-recovery-assistant-e90bb691-c2a7-4697-a94f-88836856c72f

Decommission your on-premises Exchange servers after using hybrid migration

 As of writing (07/09/2020)  the short answer is:

1. Don't, at least not fully if you are keeping AD FS or AD Sync.

For the long answer see (https://docs.microsoft.com/en-us/exchange/decommission-on-premises-exchange) and the following blog (https://techcommunity.microsoft.com/t5/exchange-team-blog/decommissioning-your-exchange-2010-servers-in-a-hybrid/ba-p/597185)

But basically if you fully remove the Exchange system while still keeping AD Sync which is a requirement for AD FS too then your user admin tasks for Exchange 365 becomes more tricky as you will have no EMC on-perm but all the Exchange settings are still stored there and not be done via Microsoft 365.

Recommend Steps for Deleting Microsoft 365 User

1. Confirm OneDrive retention is right for the company at default its 30 days
   https://docs.microsoft.com/en-us/onedrive/set-retention
2. Decide who is getting access to the users OneDrive and emails
3. Depending on if the account is AD synced or Cloud only do one of the following
1. AD Sync
1. Delete user in AD and force a delta
2. Confirm user has been related out of Microsoft 365
3. Restore user in 365 and reassign its license.
   
   It will now be a cloud only account with no sync back to On-Prem, form here can follow cloud only
2. Cloud Only
1. Select user in Active users and delete (Follow recommend flow)
2. Give access to users OneDrive as needed
3. Give Access to users Emails as needed
   
   If you are doing this from a recently broken synced account it may take a few minutes and a page refresh for the right options to appear in delete options.
   https://docs.microsoft.com/en-us/microsoft-365/admin/add-users/delete-a-user?view=o365-worldwide 

This is a secure and clean way to handle user deletion while keeping on-prem AD clean while also fixing an issue with hybrid exchange set ups / migrations which can result in shared mailboxes getting deleted from Microsoft 365 if they once where a private mailbox moved from on-prem exchange 

Convert a user mailbox to a shared mailbox

https://docs.microsoft.com/en-us/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox?view=o365-worldwide

Side note

Quick consideration when converting to a shared mailbox,  this can be done to free up the license as long as the mailbox is under 50GB, any larger and it will still need a license.

M365 and Azure on-prem AD Sync Tool force a Delta update

1. Run PowerShell Elevated
2. Run the following "Import-Module –Name "C:\Program Files\Microsoft Azure AD Sync\Bin\ADSync" -Verbose"
3. Run "Start-ADSyncSyncCycle -PolicyType Delta"

This has to be done on the server that has the AD sync tool installed on.

Shared mailboxes are unexpectedly converted to user mailboxes after directory synchronization runs in an Exchange hybrid deployment

There is random issue that can affect Microsoft 365 shared mailboxes if you have a synced user account that has been convert within the 365 portal to a shared mail box.

Where it will dismount the shared mailbox and convert the user back in to a user within 365.  the fix is to change the following AD attributes with AD.

msExchRecipientTypeDetails 34359738368
msExchRemoteRecipientType 100

Let the AD sync to 365 and then give the user an Exchange 365 license and this should re-join the mailbox.  Once that's done convert back in to a shared and it should no longer randomly disappear.

Microsoft KB2710029