Offboarding checklists get worked through at the end of the day by someone who has done it forty times. Step six is "remove the mailbox". There are two people at the company with similar names. You can see where this is going.
Mailbox deletion is unusual among administrative actions in that it destroys data with no natural undo — the storage is gone, the address is released, and recovering a deleted mailbox from backup is a support ticket and a bad afternoon. It's also, in most systems, one click behind a confirmation dialog that everybody clicks through.
A retention window changes the shape of that mistake: a deleted mailbox goes to a recycle bin instead of being destroyed, and restoring it is one action. This covers how the window works, what it does and doesn't protect, and where the sharp edges still are.
What a Deleted Mailbox Actually Does Now
A deleted mailbox has its status set to trashed, with a record of who did it and when. The storage is untouched. Aliases attached to it survive. The address isn't released.
The mailbox appears under Recently deleted in the dashboard, with the option to restore it or purge it immediately. After the retention window — seven days by default — a daily job purges it permanently.
One thing does happen immediately: open webmail sessions are terminated. A deleted mailbox should stop being usable the moment it's deleted, whether or not it's recoverable, and leaving a live session open would mean a "deleted" mailbox that someone is still reading mail in.
The reasoning behind holding the address rather than freeing it's worth stating. Releasing an address immediately means it can be recreated by someone else, and then mail intended for the person who left is delivered to a new person. Holding it for the retention window makes that impossible, and after the purge the address genuinely is free again.
What a Trashed Mailbox Does and Does Not Do
| Behaviour | While trashed |
|---|---|
| Stored mail | Intact |
| Aliases | Preserved, restored with the mailbox |
| Address | Held — can't be recreated by anyone else |
| Login | Disabled; existing webmail sessions terminated |
| Receiving new mail | No |
| Appears in the mailbox list | No — only under Recently deleted |
| Counts against the domain's mailbox limit | No — the slot is freed immediately |
The row that matters most is the one about receiving mail. A deleted mailbox doesn't accept new mail. The window protects what was already there; it doesn't queue what arrives afterwards. If you delete a mailbox on Monday and restore it on Thursday, everything sent in between was rejected at delivery and isn't waiting anywhere.
That's worth being blunt about, because "recycle bin" sets an expectation of full reversibility. Restoring a deleted mailbox recovers it and its history. It doesn't recover three days of mail that had nowhere to go. If the address must keep receiving during an offboarding, set forwarding before you delete anything.
Restoring a Deleted Mailbox, and What Can Block It
Open Recently deleted, find the deleted mailbox, click Restore. It becomes active again with its mail, aliases and address. Several can be restored in one action, which matters when the mistake was a bulk operation with a bad filter.
There's one way a restore can fail, and it isn't obvious: the mailbox limit is re-checked on restore.
A deleted mailbox frees its slot on the domain immediately. If somebody creates a new mailbox in the meantime the slot is taken, and restoring would put you over the plan limit. The restore is refused with an explanation rather than silently exceeding the cap.
The fix is to free a slot — delete something genuinely unneeded, or upgrade the plan — and restore again. Worth knowing before you need it, because the moment you discover it's otherwise the moment you're already having a bad day.
Purging early is also available, and it's a real operation rather than a formality: it skips the retention window and destroys the deleted mailbox now. Use it when someone left under circumstances that make an immediate wipe the point, or when you're certain and want the address back straight away.
Where There Is No Safety Net
The recycle bin covers mailboxes. It doesn't cover everything, and the exceptions are the expensive ones.
Deleting a domain destroys its mailboxes permanently. There's no recycle bin and no deleted mailbox to restore. This is the single most destructive action available in the dashboard, and it's worth treating with the seriousness it deserves — particularly for anyone automating provisioning, where a wrong identifier in a script is easier to produce than a wrong click in an interface.
Deleting an account is the same, at larger scale. Everything goes.
Individual messages are a different system. Deleting a message puts it in the mailbox's own Trash folder, which has its own behaviour and its own retention. The mailbox recycle bin is about the mailbox as a whole.
Retention isn't backup. Seven days protects against a deleted mailbox you notice quickly. It doesn't protect against a corruption discovered in three weeks, and it isn't an archive. If you've a legal retention requirement, export the mail properly — see exporting your data.
Over the API
Everything above is available programmatically, which matters because automation is where accidental deletion actually happens.
Deletion is deliberately two-step. The first call creates a delete intent that deletes nothing and returns a description of what would happen, including risk flags for forwarding rules, aliases, and active migrations that would be affected. It expires after ten minutes. The second call confirms it and requires an explicit confirmation header.
Confirming now moves it to the recycle bin rather than destroying it, so a deleted mailbox is recoverable over the API exactly as it is in the dashboard — the same model Microsoft 365 uses for soft-deleted mailboxes. Trashed mailboxes can be listed and restored through the API, and an agent over MCP has the same tools.
Domain deletion has no such recovery. If you automate provisioning, don't automate domain deletion — leave that requiring a human who can be asked whether they're sure. Detail in safety rails and delete intents.
A Better Offboarding Sequence
Most accidental deletions are a checklist executed in the wrong order. This order removes access first and destroys nothing until the end.
- Change the mailbox password. Access is revoked immediately and nothing is lost. This is the step that actually matters on the day someone leaves.
- Set forwarding to whoever is taking over. Do this before deleting anything — a trashed mailbox doesn't receive mail, so forwarding configured afterwards has nothing to forward.
- Set an auto-reply naming the new contact, so senders update their records rather than repeatedly emailing a silent address. See out-of-office replies.
- Wait. Thirty to ninety days of forwarding tells you what that address actually receives. It's nearly always more than anyone expected.
- Export anything that must be kept for legal or contractual reasons.
- Then delete, with a week of retention behind you as the last line of defence rather than the plan.
Steps 1 and 2 solve the security and continuity problem on day one. The deletion is housekeeping, and housekeeping should never be urgent.
Frequently Asked Questions
How long do I have to restore a deleted mailbox?
Seven days by default, after which a daily job purges it permanently. The mailbox is listed under Recently deleted for the whole window.
Does a deleted mailbox still receive mail?
No. The window preserves what was already stored. Mail sent to the address while it's trashed isn't delivered and not queued. Set forwarding before deleting if the address needs to keep working.
Does a deleted mailbox count against my plan limit?
No, the slot is freed immediately. That's also why restoring a deleted mailbox can fail — if the slot was taken in the meantime the restore would exceed the limit, and you'll need to free one first.
What happens to the aliases of a deleted mailbox?
They are preserved while the mailbox is trashed and come back with it on restore. The address itself is held too, so nobody can recreate it during the window.
Can I purge a deleted mailbox immediately?
Yes — purging from Recently deleted skips the retention window and destroys it immediately, freeing the address at once.
Is deleting a domain recoverable?
No. Domain and account deletion remove their mailboxes permanently and don't use the recycle bin. Treat both as irreversible.
Does the recycle bin apply to API deletions?
Yes. Confirming a delete intent moves the mailbox to the recycle bin, and trashed mailboxes can be listed and restored through the API and over MCP.
Is this a backup?
No. It's a short window that turns a fast mistake into an inconvenience. For retention requirements, export the data properly.
