Question

During an investigation of a phishing incident in Microsoft Defender XDR, you use Threat Explorer to remediate 40 malicious emails by soft-deleting them. Two hours later, the sender is confirmed legitimate after the block was based on a misconfigured detection. Users report the messages are missing entirely from their mailboxes, including Deleted Items. Which action lets you recover the messages back to users' inboxes with the least effort and without involving each user?

Accepted Answer

In the Action Center, select the completed remediation action and choose 'Move to inbox' to reverse the soft delete for all affected mailboxes

Answer

Instruct each user to recover the items from the Recoverable Items 'Deletions' folder using Outlook's Recover Deleted Items feature

Answer

Create an eDiscovery content search for the messages and export them, then re-import the PST files into each mailbox

Answer

Run a new Threat Explorer remediation and select the 'Hard delete' action, which restores previously soft-deleted mail