[German]I'll bring up another rather crude observation: In the spring of 2025, an administrator reported that contacts and later emails were mysteriously deleted from some of his users' Microsoft 365 accounts, initially sporadically. Now I've come across a similar case on the Microsoft forum.
A brief review of the old case
In February 2025, German blog reader Christian M. contacted me with a problem related to Microsoft 365 and Exchange Online. As an administrator, he noticed that all contacts were suddenly being deleted on a daily basis from a handful of Microsoft M365 accounts in his company.
There was no discernible pattern on the end-user side, he said, and the company uses clients running Windows and macOS. In the log files, the reader could see that suddenly huge numbers of actions "MovedToDeletedItems" were being recorded for one mailbox.
I had addressed this case in detail within my German blog post Autsch: Kontakte werden in Microsoft 365 gelöscht, and there is also an English version Are contacts are suddenly deleted in Microsoft 365? of this blog post. In this German comment, Frank Carius, a German MVP, suggested that a client (smartphone, etc.) could be causing this effect and made suggestions for troubleshooting.
At the end of March 2025, the blog reader contacted me again and reported that, as of March 25, 2025, a user had suddenly encountered a situation where emails were being deleted from the archive folder. The reader wrote that approximately 15,000 emails had been deleted so far and that the number in the archive folder was visibly decreasing. The issue is discussed in the article Microsoft 365: Mails are suddenly deleted after contacts deletion. There was no real explanation – possibly a full storage quota plays a role – email rules could be excluded from memory.
New case in the Microsoft Forum
Ende of August 2025, I came across the German thread Outlook-Emails löschen sich automatisch from August 13, 2025 on Microsoft Q&A. A user complains there that since August 12, emails in his email account (a company account) have been automatically deleted "under his eyes."
Even after multiple searches and checks by several employees, the IT service department cannot explain what the root cause might be. The affected user was initially able to recover the emails by logging directly into Outlook and restoring all deleted emails from the "Deleted" folder under "View." However, this only applied to emails that had been deleted up to the previous morning. All other emails remain missing.
The case reminded me of the Microsoft 365 case mentioned above in the article Microsoft 365: Mails are suddenly deleted after contacts deletion. While searching, I came across similar descriptions in older threads on reddit.com here, here and here.
Mobile devices Outlook app as the root cause?
If you can exclude "rules" for handling messages in Outlook, there is another wild but plausible explanation – if I understood everything correctly when skimming through the reddit.com threads. Those affected used a smartphone with the Outlook app to access their emails.
And contacts were blocked on these smartphones. In one case, the affected user had mistakenly blocked their own email address as "spam," which resulted in their emails being automatically deleted. In a comment here, an administrator wrote that they had to reset a smartphone (iPhone). After that, the problem was solved.
Old apps and Pureview as debuggers
I found this comment in another (two-year-old) reddit.com thread interesting. The administrator responsible used Microsoft's Purview to check Purview's compliance for MovetoDeletedItems and soft delete actions in relation to the mailbox. He then obtained the ClientAppId GUID of the actor responsible for the deletion. By executing Get-AzureADApplication, he obtained the name of the application in question.
In this case, the problem was that Graphus from Kaseya was running and a filter rule (referred to as a "proof of concept," or PoC) was defined there, which then deleted emails. Once the Graphus app registration was deleted, the problem of deleted emails disappeared.
Hence the question: have any administrators among our readers observed something similar?
