Office 365 student email appears to delete automatically

[jimmy_2k]

Hi all

 

I have a case with a student where periodically all of his emails are moved into his deleted items. There is no pattern to this and the only evidence I can find is that the student must be doing this themselves. The parent has told us that she herself has observed that his emails are being auto deleted. This only seems to happen when the student is logged on and not at any other time.

 

I have reset the password, asked them not to login via anything other than an internet browser. Not heard from them for a few days and now his emails have been deleted again. He was in a teams lesson, then "kicked out" and not able to rejoin. I've opened his calendar and the lesson was still in his calendar.

 

3 of us have taken a look at this and we can't find a reason other than manual intervention to explain this.

 

I've also had reports of other students in this year group declining calendar invites to teams lessons and they're declining them and its removing and blocking all subsequent calendar entries for these sessions.

 

Anyone have any ideas?

[computer_expert]

What does mailbox auditing say? https://docs.microsoft.com/en-us/microsoft-365/compliance/enable-mailbox-auditing?view=o365-worldwide

 

Move, MoveToDeletedItems, RecordDelete and SoftDelete would be the Mailbox actions to look for.

[StormTrooper59]

The bit you mentioned about declining a lesson which then cancels it in the calendar, I had something similar.

 

What solved it for us, was when I checked the meeting details via the 365 Mail (I didn't try the teams calendar for this part) calendar I could see the meeting organiser was the Team and not the individual teacher. So any member of the team could decline the meeting and it would decline it for everybody in that team. The way around this was to use the Calendar option within Teams on the left hand side and scheduling a meeting that way, rather than going into the Team itself and then scheduling on the top right where it says schedule meeting.

 

I had a mix of teachers scheduling there lessons using both methods and found that this only affected those who scheduled there lessons from within there Team.