How to restore a deleted user in Microsoft 365

Restoring a deleted user in Microsoft 365 is a single click in the Deleted users list, provided it is done within 30 days and nothing else has taken the user's address in the meantime. The mailbox, OneDrive, licences, and group memberships come back with the account. After the window closes, the account is gone for good and what can be recovered depends on holds and retention settings that had to be in place before the deletion.

For the process side — why leavers should be blocked and then deleted on a schedule rather than deleted on the day — see how to offboard a user. The related Microsoft 365 group case is the group restore runbook.

Prerequisites

• User Administrator role (Global Admin not required).
• Confirmation of when the deletion happened: Entra → Users → Deleted users shows the deletion date and the permanent-deletion date for each entry.
• For hybrid: access to on-premises AD and the AD Recycle Bin (Get-ADObject -IncludeDeletedObjects), and knowledge of which sync you run — see Entra Connect vs Cloud Sync.
• A check for conflicts: search Active users and shared mailboxes for the user's UPN and primary SMTP address.

Steps

1. Find the user

Microsoft 365 admin center → Users → Deleted users, or Entra admin center → Users → Deleted users. Both show the same soft-deleted objects.

With Graph PowerShell:

Connect-MgGraph -Scopes "User.ReadWrite.All"
Get-MgDirectoryDeletedItemAsUser -All | Where-Object UserPrincipalName -like "j.smith*" | Select-Object Id,UserPrincipalName,DeletedDateTime

2. Resolve conflicts

If someone re-created the user or reassigned the address, the restore will fail with a conflict. Either remove the address from the new object (Set-Mailbox new@contoso.com -EmailAddresses @{remove="smtp:j.smith@contoso.com"} for Exchange; Update-MgUser for UPN) or accept a new UPN on restore and tidy up afterwards.

3. Restore

Admin center: select the user → Restore user → choose to keep the UPN or, if there is a conflict, assign a new one → confirm. Or:

Restore-MgDirectoryDeletedItem -DirectoryObjectId <object id>

Restoration is immediate for the account; the mailbox reconnects within minutes, OneDrive within about a day.

4. Hybrid: restore on-premises first

Restore the AD object (Restore-ADObject -Identity <objectGUID>), confirm it lands in a synced OU with the original ms-DS-ConsistencyGuid / objectGUID, then force a sync: Start-ADSyncSyncCycle -PolicyType Delta. Entra matches the incoming object to the soft-deleted user by source anchor and restores it. If the AD object cannot be recovered with the same source anchor, restore the cloud object and use Set-MgUser -OnPremisesImmutableId to match the new AD object — the Entra Connect recovery runbook covers the matching rules.

5. Re-enable and reset

A restored user comes back with the sign-in state it had at deletion (usually blocked, if offboarding was followed). Re-enable sign-in, reset the password, and check MFA methods — if the person is genuinely returning, a MFA reset with a Temporary Access Pass gets them in cleanly.

6. Check licences

Licences are restored if the same SKUs are still available; if the seats were reused, the user shows a licensing error and the mailbox is at risk again. Assign the licence (or add the user back to the licensing group) immediately.

Verify

• The user appears in Active users with the expected UPN; Get-Mailbox returns the mailbox with the same ExchangeGuid it had; the OneDrive URL opens.
• Groups on the user lists the memberships from before deletion (Microsoft 365 group memberships are restored; some dynamic memberships re-evaluate).
• The user can sign in and sees their mail and files.

Roll back

Deleting the user again returns them to Deleted users with a fresh 30-day clock. If you restored to a temporary UPN, rename to the original once the conflict is cleared (Update-MgUser -UserPrincipalName), and update the primary SMTP address in Exchange separately — the UPN change does not rename the mailbox address. If the 30 days have already passed, the account is not restorable: recover mail from an inactive mailbox (if a litigation hold applied) with New-MailboxRestoreRequest, recover the OneDrive through the SharePoint admin center's Deleted sites within its retention period, and create a new account for the person.