I've been receiving reports from users across two different M365 tenants that some incoming emails are vanishing from their inboxes almost instantly. Not only do these emails disappear, but they also get deleted from the Deleted Items folder, making them recoverable only through the 'Recover recently deleted items' feature.
Here are some details:
- There are no rules set up that could be causing this issue.
- We haven't identified any tenant rules that might be responsible either.
- The Exchange message trace logs confirm that the emails are coming in without issues and passing all checks.
- We haven't found any indicators that may suggest another system is flagging these emails.
Initially, we thought this might be related to a recent incident where certain domains were incorrectly flagged as spam, but since these emails seem to pass those checks and the message trace shows them as delivered without any flags, that seems ruled out.
We also considered the possibility of a specific tenant issue or some external/internal handling rules, but one of the emails that disappeared was actually exchanged between users within the same tenant, which complicates things further.
The earliest instance of this issue we have tracked was on February 6th, and we only began checking with users and going through the recovery process recently. Has anyone else faced a similar situation in the past couple of days?
4 Answers
It sounds like Defender might be automatically removing these messages, as that wouldn't show up in a message trace since it happens post-delivery. Other email security systems like Proofpoint or Mimecast could potentially do something similar too.
Have you activated auditing in the Purview portal? You can export logs of email deletions to see what's causing this. Just note that move auditing is turned off by default, but you can enable it for the mailboxes you're interested in investigating further.
Did anyone happen to recall the messages? It could provide some insight into what's happening.
No one tried recalling them, and we don't have any systems in place to recall emails once they've been received.
I've seen this kind of behavior occur when accounts are compromised, where a malicious actor goes through and deletes everything. Could that be a possibility in your case?
That seems unlikely since the emails getting deleted seem pretty random and some are trivial, plus it's odd to think that different users from different tenants could be compromised simultaneously.
We checked Defender, but it doesn’t seem like it should grab an email after allowing it through, and we don't have much expertise with its logs. We're looking into it further and hoping to find an answer.