How To
Summary
If a user deletes an image in Teams, the Graph API cannot retrieve the image even while 3rd part applications such as Merge 1 App is in use to capture chat messages. However, Microsoft Purview can still retrieve the deleted image from the full chat message.
Objective
Per Microsoft and other sources, there is a time frame for recovering deleted images from Microsoft Teams conversations using the Microsoft Graph API.
This applies even when using tools like Merge1 for capturing electronic communications (E-Comms), as Merge1 relies on Graph API endpoints for data ingestion, and recovery via Graph API is subject to Microsoft's built-in retention windows for deleted content.
Environment
Microsoft Teams
Steps
Recovery depends on Microsoft 365 retention and compliance copy lifecycle, not Merge1 or the Graph API.
If the compliance copy of the image has been deleted (aged out or purged), then Graph API cannot recover it, and Merge1 cannot capture it retroactively.
Once the compliance copy is deleted, it is unrecoverable.
Graph API cannot retrieve it, and eDiscovery cannot access it.
This includes files and images shared in conversations, because attachments are included in the compliance data set.
*If retention keeps content (e.g., 1 year, 7 years)
The compliance copy (and images/attachments) remain discoverable and Graph-accessible during the entire retention period.
*If retention auto-deletes content (e.g., 30 days, 90 days)
After that window expires, the compliance copy is destroyed → Graph API cannot recover it.
*If the item was purged via eDiscovery
It is permanently deleted and cannot be recovered.
In summary, Microsoft really does not provide a single fixed time for all organizations.
The retention policy determines it.
Key Time Frames
- User-deleted messages in chats (1:1, group, or meeting chats): Deleted messages, including embedded images, can be accessed and recovered via Graph API endpoints like /chats/getAllMessages or /chats/getAllRetainedMessages for up to 21 days after deletion.
- Deleted messages in channels: These can be accessed via endpoints like /channels/getAllMessages or /channels/getAllRetainedMessages for up to 30 days after deletion (or from deleted teams/channels).
- Processing delays: There can be a 1-7 day delay in permanent deletion due to background timer jobs. User-deleted content remains "soft-deleted" and potentially visible/recoverable in Teams for the initial 21 days before full processing.
Images in Teams chats are attachments, which fall under the same compliance and retention rules as messages.
This is confirmed by Microsoft’s purge documentation, which lists "attachments shared in a Teams conversation" as part of recoverable/purgeable items.
Once permanently deleted (either by retention expiration or purge), images cannot be recovered by Graph API.
NOTE: After this period, the content is moved to a hidden storage (SubstrateHolds) for compliance purposes and is no longer directly recoverable via standard Graph API calls—though it may still be searchable via eDiscovery tools if retention policies or holds are in place. Hence why Purview is able to retrieve it!!
Considerations for Images Specifically
- Embedded images (e.g., pasted directly into a message) are treated as part of the message and follow the same recovery window as the message itself.
- If the image is an attachment (e.g., uploaded as a file), it may be stored in SharePoint or OneDrive, where deleted files remain in the recycle bin for up to 93 days. You can use Graph API to access and restore from the recycle bin (e.g., via /sites/{site-id}/lists/recyclebin/items), independent of the message deletion.
- Thumbnails, announcement images, or reactions are not retained under Teams retention policies and cannot be recovered.
Impact of Merge1
- Merge1 captures Teams E-Comms in near real-time using Graph API, archiving messages, images, and attachments to a separate repository for compliance and long-term retention as long as the compliance copy still exists.
- Once captured by Merge1, deleted content can be recovered from the Merge1 archive without the 21/30-day Graph API limit, depending on your configured archive retention policy (which can be indefinite or custom, e.g., 7+ years for regulatory needs). Recovery from Merge1 typically uses its own API or interface, not directly via Graph API.
- However, if you're specifically using Graph API for recovery, the Microsoft-imposed limits (21-30 days) still apply, as Graph API accesses live Microsoft 365 data, not the Merge1 archive.
Merge1 does not independently store Teams history unless your configuration is set to archive it externally.
So:
*If Merge1 already ingested the image before deletion
You can retrieve it from Merge1, even if Teams has deleted it.
*If Merge1 did not ingest it before the compliance copy was deleted
Merge1 cannot recover it, and neither can Graph.
Important Clarification: Graph API does not override retention time limits
The Microsoft Graph Teams Export and eDiscovery APIs respect the compliance copy lifecycle.
You cannot use Graph to retrieve:
- Permanently deleted compliance data
- Items removed by retention expiration
- Items purged from eDiscovery searches
What Microsoft does specify about time limits
While not directly about chat images, Microsoft provides a general rule:
Deleted directory items remain recoverable for up to 30 days before becoming permanently deleted.
This mirrors how other M365 services treat deletion but is not the exact mechanism for Teams chats. For Teams, retention policies dictate the deletion timeline, not a universal 30‑day rule.
Additional Information
- Retention policies: If your organization has Microsoft Purview retention policies enabled for Teams, deleted content may be preserved longer in compliance storage (e.g., indefinitely or for a set period like 7 years). This extends searchability via eDiscovery but doesn't change the Graph API recovery window for standard access.
- eDiscovery integration: For compliance scenarios, use Graph API's eDiscovery endpoints (e.g., /security/cases/ediscoveryCases) to search and export deleted content beyond the initial soft-delete period, if holds are applied.
- Recommendations: To minimize reliance on short windows, ensure Merge1 is configured to capture data frequently, and test recovery workflows. If longer-term recovery is critical, prioritize Merge1's archive over direct Graph API calls.
See the Merge1-User-Guide.
NOTE: If your setup involves specific retention policies or custom Merge1 configurations, the exact time frame could vary.
Final Review
There is a time-bound limit.
You can only recover a deleted image from a Teams conversation using Graph API (and therefore via Merge1 E‑Comms Capture) as long as the compliance copy still exists, which is controlled by:
- Your Microsoft 365 Retention Policy, and
- Whether the item has been purged.
Once the compliance copy is:
- Deleted by retention expiration, or
- Purged via eDiscovery,
NOTE: It is permanently unrecoverable by Graph API and Merge1.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
27 March 2026
UID
ibm17267927