Back to Blog
Guide

Can My Employer See Deleted Teams Messages? Retention Decides

Yes, if your company keeps Teams messages with a retention policy or a hold. The chat shows only that a message was deleted, but compliance admins can find the full text with eDiscovery, and the originals of edited messages too.

Slack Green Team
September 24, 2026
October 26, 2026
6 min read
Share:
microsoft teams
privacy
employee monitoring
ediscovery
remote work

Yes, in many companies. When you delete a Teams message, people in the chat see only "This message has been deleted." But if your company has a Microsoft Purview retention policy for Teams, or a legal hold on your mailbox, a copy of the message is kept and a compliance admin can find it with eDiscovery. Microsoft's documentation says the same about edits: the original text of an edited message is kept too. Without a retention policy or hold, Microsoft does not promise to keep a deleted message, and it goes away. The Teams app code agrees: when we read it on 26 October 2026, a deleted message came back from the server with a delete time and a "can be undeleted" flag, so deleting first hides a message and does not erase it.

Your manager usually cannot do this from Teams. Searching deleted messages needs an eDiscovery role in Microsoft Purview, which IT, legal or HR compliance staff hold, and the search itself is logged. The details are below.

The Slack answer to this question is in can Slack see deleted messages.

Where a deleted Teams message goes

Teams keeps a compliance copy of chat and channel messages in Exchange Online mailboxes. Chat messages go to a hidden folder in the mailbox of each person in the chat. Channel messages go to a hidden folder in the team's group mailbox. Microsoft says these folders "store data that compliance administrators can search with eDiscovery tools."

With a retention policy, Microsoft documents this path:

  • You delete the message. It disappears from the Teams app for everyone in the chat.
  • For 21 days, the message stays where it was, out of sight.
  • Then it moves to SubstrateHolds, a hidden folder for soft-deleted items, for at least 1 day.
  • When the retention period ends, a timer job deletes it for good, usually within 1 to 7 days.
  • A hold stops the last step. Microsoft: "While the mailbox is included in an applicable hold, Teams chat and channel messages that have been deleted will no longer be visible in the Teams app but will continue to be discoverable with eDiscovery." Holds are used for lawsuits and internal investigations, and you are not told when one is placed.

    What the Teams app code shows about deleting

    We read the code of the Teams web client that teams.microsoft.com served on 26 October 2026; downloading it needs no sign-in. This script prints the fields Teams loads for a deleted chat message and checks for the soft and hard delete fields:

    import re, urllib.request
    UA = {"User-Agent": "Mozilla/5.0 Chrome/140.0"}
    CDN = "https://teams.public.onecdn.static.microsoft/teams-modular-packages/hashed-assets/"
    get = lambda u: urllib.request.urlopen(urllib.request.Request(u, headers=UA), timeout=90).read().decode()
    html = get("https://teams.microsoft.com/v2/")  # no sign-in needed
    code = get(CDN + re.search(r"hashed-assets/(async-entry-\w+\.js)", html).group(1))
    print(re.search(r"fragment DataClientChatDeletedMessageFragment_deletionInfo on Message \{[^}]*\}[^}]*\}", code).group(0))
    for f in ("softDeleteReason", "hardDeleteReason", "hardDeleteTime", "ThreadActivity/RetentionDeleted"):
        print(f, f in code)

    What it printed:

    fragment DataClientChatDeletedMessageFragment_deletionInfo on Message {id,deleteTime,deletionInfo {showMessageAsDeleted,canBeUndeleted,deleteFailed},isDeletedByAdmin,sharedToMessageId,version}
    softDeleteReason True
    hardDeleteReason True
    hardDeleteTime True
    ThreadActivity/RetentionDeleted True

    Three things follow from that output:

  • A deleted message is still a message object with a deleteTime, and the server tells the app whether it canBeUndeleted. That is how Undo can bring it back, so the text is still stored after you press Delete.
  • The schema keeps a soft delete (softDeleteReason) apart from a hard delete with its own hardDeleteTime. That matches the two stages in Microsoft's retention path above: hidden first, purged later.
  • isDeletedByAdmin marks messages an admin removed, and RetentionDeleted is a chat system message for messages a retention policy removed. Both are separate from a delete by the sender.
  • Can my employer see edited Teams messages?

    Other people in the chat see the new text with an Edited label. They cannot open the old version. Teams has no edit history for users.

    Compliance admins can. Microsoft's retention documentation says: "If a chat or channel message is edited or deleted by a user during the retention period, the original message is copied (if edited) or moved (if deleted) to the SubstrateHolds folder." So under a retention policy, each earlier version of an edited message stays searchable.

    What coworkers see when you edit, and how read receipts work, is in does Teams show edited messages.

    Who can see what

    WhoDeleted messageEdited message
    People in the chatA "This message has been deleted" lineThe new text and an Edited label
    Your manager, in TeamsThe same as anyone in the chatThe same as anyone in the chat
    Compliance admin, with eDiscoveryThe full text, if retention or a hold appliesThe original text too, if retention applies
    The audit logA "Deleted a message" event (MessageDeleted)An "Edited a message" event
    Email and notifications already sentAny copy staysAny copy stays

    The last row catches people out. If Teams already emailed a missed-message notice, or a colleague's phone showed the text in a notification, deleting the message later does not pull those copies back.

    What an admin runs to find them

    These are the searches a compliance admin can run: the audit search in Exchange Online PowerShell, the content search in Security & Compliance PowerShell. Both need admin roles a normal user does not have:

    # audit log: who deleted Teams messages in the last 30 days
    Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) `
      -Operations MessageDeleted -ResultSize 100
    
    # content search: Teams messages in one person's mailbox
    New-ComplianceSearch -Name "teams-review" -ExchangeLocation "person@company.com" `
      -ContentMatchQuery "kind:microsoftteams"
    Start-ComplianceSearch -Identity "teams-review"

    Microsoft marks some Teams audit events as available only with certain licenses, so not every company has the MessageDeleted record. The content search is available with the standard Purview tools.

    Can my employer see all my Teams messages?

    Every chat and channel message you send in a work account sits in company mailboxes, and a compliance admin with eDiscovery can search them, including private one-to-one chats. No one reads them by default. A search is a deliberate step, usually for a legal request, an HR case or a security review. Some companies also run communication compliance policies that scan messages for set words and flag matches to reviewers. Who can read your chats, and each tool they use, is in can my employer read my Teams chats.

    What Teams records beyond messages, such as sign-ins, activity counts and your status, is in does Teams track your activity. The wider picture of workplace monitoring is in how do employers monitor remote workers.

    Calls follow different rules from chat. What your employer can hear, record and search is in can my employer listen to my Teams calls.

    Can you undo or fully delete a message?

  • • Undo. Right after you delete a message, Teams shows Undo in its place. Use it, and the message comes back for everyone.
  • • Fully delete. You cannot remove the compliance copy. Only the retention policy, set by your admin, decides when it goes.
  • • Delete the chat. Deleting a whole chat removes it from your chat list. The other people keep it, and the compliance copies stay.

Teams vs Slack on deleted messages

Microsoft TeamsSlack
What the chat shows"This message has been deleted""This message was deleted" or nothing
Kept for the employer whenA Purview retention policy or hold appliesThe workspace keeps messages and edit logs, or uses a legal hold
Who can search itCompliance admins with eDiscoveryOwners with exports or Discovery API access, by plan

The Slack details, by plan, are in can Slack see deleted messages, what each step removes when you delete a DM in Slack is from our own test, and what Slack admins can read in DMs is in can Slack be used to monitor employees.

FAQ

Can my boss see my deleted Teams messages? Not from Teams. Your boss sees what anyone in the chat sees. A compliance admin can find the text with eDiscovery if your company retains Teams messages.

Does Teams keep deleted messages? Only if a retention policy or a hold applies. Then the message stays hidden for 21 days, moves to the SubstrateHolds folder, and is deleted when the retention period ends.

Does Teams show edited messages? It shows an Edited label, not the old text. Compliance admins can see the original if retention applies.

Can IT recover a deleted Teams chat? IT can find retained messages with eDiscovery and export them. They cannot restore them into your chat.

Is deleting a Teams message logged? It can be. The audit log has a MessageDeleted event, on the licenses where Microsoft records it.

Will I know if my employer searches my Teams messages? No. eDiscovery searches are logged for admins, not shown to you.

Related Articles

Guide

Can My Employer Listen to My Teams Calls?

Not live, on ordinary Teams calls and meetings: Teams has no silent listen-in for admins. Your employer can record calls with a notice, record every call under a compliance policy, keep transcripts, and see who you called and for how long. The one live exception is call-queue monitoring.

Slack Green Team
Guide

Does Teams Show Your Location? Work Location, Wi-Fi and Privacy

Teams does not show coworkers a map of where you are. It shows a work location, In the office, a building name or Remote, when you set one or when your company turns on workplace check-in, which reads the office Wi-Fi. Your profile card shows your local time, and admins see sign-in IP addresses. What each feature shares and how to turn it off.

Slack Green Team
Guide

Can My Work Laptop Hear Me? When Your Employer Can Listen Through the Microphone

During calls and recorded meetings, yes. Outside calls, only if a program on the laptop turns the microphone on. Device management such as Intune or Jamf does not stream audio, and Windows and macOS both show when an app uses the mic. How to check, and where the law draws the line.

Slack Green Team