Restoring Deleted Items From M365 SharePoint Site

Introduction

In SharePoint online, when an item is deleted, the item first goes to the primary recycle bin, and if the site owner deletes it from the primary recycle bin then it gets moved to the secondary recycle bin. MSFT put these steps to have strong control over the deleted items.

When a user deletes the content from the SharePoint site it goes to the Primary Recycle bin
If the user deletes from the primary recycle bin it moves to the secondary recycle bin
Only site collection admin will have access to secondary recycle bin and site collection admins will get access to restore the items from it.
The retention period for a deleted item is 93 days, which means if the item deleted is older than today’s date by 93 days there is no way the item can be retrieved. The items in the recycle bin will be cleaned up by a daily scheduled job, which checks the item's deleted date and cleans up if older than 93 days.

In this article, we will go through the following scenarios.

Scenario 1

Restoring the recycle bin items from the SharePoint UI.

Scenario 2

Restoring the recycle bin items using a power shell for smaller volume.

In the next article, we will cover the below scenario in detail

Scenario 3

Restoring the recycle bin items using a power shell for larger volume.

Scenario 1 - Restoring the recycle bin items from the SharePoint UI

In this scenario, it is simply where the users can go to site contents, and check the recycle bin items. Here users can select single or multiple files and click on restore. This scenario works for smaller volumes may be from 100s up to 1000s.

Step 1

Step 2

On the top right side, you can see recycle bin items.

Restoring deleted items from M365 SharePoint Site

Step 3

You can select if single or multiple and select restores.

Restoring deleted items from M365 SharePoint Site

The above scenario works fine for single files or multiple files. What if we need to have the audit of the restore items saved in a log file, that is where we can use the Power shell script. Lets’ dive into scenario 2.

Scenario 2 - Restoring the recycle bin items using power shell for smaller volume

We can use the PnP Powershell module, and import the right version of the PnP Powershell module and then use the restore option. Below are the simple steps to follow,

Step 1

Import the latest version of the PnP Powershell module.

Import-Module PnP.PowerShell

Step 2

Connect to the SharePoint site collection using the SCA rights. To restore the items from the site collection, the account needs to have Site Collection admin rights. Note that Global Admin and SharePoint admin is not a requirement. Replace the URL value with your site collection where the items need to be restored.

Connect-PnPOnline-Url"https://YOURCOMPANYDOMAIN.sharepoint.com/sites/SITENAME"-Interactive

Step 3

Here you need to get the items from the recycle bin first, and then run the restore command. Below command line that combines both functions and does the job

Get-PnPRecycleBinItem-RowLimit2000|Restore-PnPRecycleBinItem-Force

Here it gets the first 2000 items and then runs the restore for each item.

You can also query the result set to get the items that are deleted after a specified date and then deleted by the user. The below command shows the items deleted before 2 weeks from today and is deleted by the user.

$today= (Get-Date)
$restoreDate=$today.date.AddDays(-10)
$userEmail='[email protected]'
et-PnPRecycleBinItem|? {($_.DeletedDate -gt$restoreDate) -and ($_.DeletedByEmail -eq$userEmail)} |Export-Csvc:\temp\WRARestore_0910_3.csv

Once the results are validated you can run the restore on the same result set

Get-PnPRecycleBinItem|? {($_.DeletedDate -gt$restoreDate) -and ($_.DeletedByEmail -eq$userEmail)} |Restore-PnPRecycleBinItem-Force

Points to Note
I have run across 2000 items and it took almost 2 to 3 hours to complete. Please note that your operation may be impacted by throttling, and for larger items restore the above command is not recommended. You can check the advanced mode in scenario 3 where the batching can be configured while restoring a larger set.

Step 4

You can also get the items from the Primary and Secondary recycle bins. Below commands gets the items and get the details stored in a CSV file.

Get-PnPRecycleBinItem-FirstStage|Export-CsvC:\Temp\VinayToDo_FirstStageItems.csv
Get-PnPRecycleBinItem-SecondStage|Export-CsvC:\Temp\VinayToDo_SecondStageItems.csv

You can also run in the command line to get the below output. Here I am running for the first stage. Similarly, it can be run to get items from the second stage.

Restoring deleted items from M365 SharePoint Site

Step 5

Run the restore operation. Here I am running for a second-stage recycle bin.

Get-PnPRecycleBinItem-SecondStage|Restore-PnPRecycleBinItem-Force

Complete Script

#Import the latest PnP module
Import-Module PnP.PowerShell
#Connect to SPO site using Site Collection Admin Rights
Connect-PnPOnline -Url https://pepsico.sharepoint.com/sites/vinaytodo -Interactive
#Get the result set and validate
Get-PnPRecycleBinItem -FirstStage | Export-Csv C:\Temp\VinayToDo_FirstStageItems.csv
Get-PnPRecycleBinItem -SecondStage | Export-Csv C:\Temp\VinayToDo_SecondStageItems.csv
#Run the restore operation
Get-PnPRecycleBinItem -SecondStage | Restore-PnPRecycleBinItem -Force

References

https://www.c-sharpcorner.com/article/working-with-pnp-powershell/
https://docs.microsoft.com/en-us/powershell/sharepoint/sharepoint-pnp/sharepoint-pnp-cmdlets?view=sharepoint-ps
https://docs.microsoft.com/en-us/compliance/assurance/assurance-sharepoint-online-data-deletion