Retention Policies and Labels

Retention policies and retention labels are Microsoft Purview features that help organizations govern their data by retaining what is needed and deleting what is not. They are part of the Information Governance and Records Management solutions. The core purpose is to meet regulatory requirements, reduce litigation risk, and manage storage costs.

Both policies and labels can perform three retention actions: - Retain only: Keep data for a specified period, then do nothing (no deletion). - Delete only: Delete data after a specified period. - Retain then delete: Keep data for a period, then automatically delete.

When you create a retention policy or label, you define a retention period (e.g., 7 years) and what happens at the end (delete, keep, or review). The system then applies a 'retention hold' on the content. This hold prevents permanent deletion until the retention period expires. The hold is enforced by the underlying workload (Exchange, SharePoint, OneDrive, Teams, Yammer).

For Exchange Online, retention holds are applied to mailboxes. When a user deletes an email, it goes to the Recoverable Items folder. The retention hold prevents the item from being purged from that folder until the retention period ends. For SharePoint and OneDrive, retention holds are applied at the document level. When a user deletes a file, it goes to the site's recycle bin or preservation hold library, and the retention hold prevents permanent deletion.

Retention labels can be: - Manually published: Users or admins apply the label to items via Outlook, SharePoint, or the Purview compliance portal. - Auto-applied: Based on conditions:

- Sensitive information types (e.g., credit card numbers, SSN) - Trainable classifiers (e.g., 'inappropriate text', 'resumes') - Content contains specific words or patterns - Content matches a data loss prevention (DLP) policy - Content is shared with external users

When both a policy and a label apply to the same item, the longest retention period wins. For example:

If one policy says retain and another says delete, the retain action takes precedence. The system always ensures data is not deleted prematurely.

For sensitive data, you can enable disposition review. When a retention period expires, the item enters a 'disposition review' state. An assigned reviewer must approve permanent deletion. This adds a human-in-the-loop step. Disposition reviews can be set up for both policies and labels.

A preservation lock prevents anyone (including global admins) from deleting or shortening the retention period. It is used for regulatory requirements. Once locked, the policy cannot be modified (except to extend the period). This is common for SEC or FINRA compliance.

To manage retention policies via PowerShell:

# Connect to Exchange Online PowerShell
Connect-ExchangeOnline

# Get all retention policies
Get-RetentionPolicy | Format-Table Name, RetentionPolicyType

# Create a new retention policy
New-RetentionPolicy -Name "7 Year Regulatory" -RetentionPolicyType "Modify"

# Add a retention tag to the policy (e.g., delete after 7 years)
New-RetentionPolicyTag -Name "7 Year Delete" -Type All -AgeLimitForRetention 2555 -RetentionAction Delete

For compliance labels:

# Connect to Security & Compliance Center PowerShell
Connect-IPPSSession

# Get all retention labels
Get-ComplianceTag | Format-Table Name, RetentionAction, RetentionDuration

# Create a new retention label
New-ComplianceTag -Name "7 Year Record" -RetentionAction Keep -RetentionDuration 2555 -RetentionType CreationAgeInDays

A large financial firm must retain all electronic communications (emails, instant messages) for 7 years with no deletions. They use a retention policy with a preservation lock to prevent any changes. The policy is applied to all Exchange mailboxes and Teams chats using an adaptive scope that includes all employees. The retention action is 'retain' (no deletion). They also enable disposition review for items older than 7 years to allow legal to review before final deletion. The firm uses static scopes for specific trading desks that have additional 3-year retention for certain documents. Common misconfiguration: forgetting to enable preservation lock, which would allow admins to accidentally shorten the retention period. They also set up auto-apply retention labels for any email containing 'trade confirmation' to ensure extra protection.

A hospital must retain patient records for 6 years after last treatment. They use a retention label called 'Patient Record - 6 Year' that is auto-applied to any document containing a medical record number (sensitive info type). The label action is 'retain then delete' with a 6-year period. They also have a separate retention policy for billing records (7 years) applied to the Finance department via adaptive scope. Challenge: overlapping policies cause items to be retained for the longer of the two (7 years). To avoid this, they ensure the billing policy has a shorter period or exclude certain locations. They also use disposition review for records that are near expiration to allow compliance officers to approve deletion.

A startup must delete personal data of EU citizens within 30 days of request. They use a retention label called 'GDPR - Delete after 30 days' that is manually applied by the privacy team to specific documents. They also have a retention policy for all SharePoint sites that retains content for 3 years for business continuity. The GDPR label overrides the policy for the specific items. They use PowerShell to regularly run reports on items with the GDPR label to ensure timely deletion. Pitfall: users forget to apply the label, so they set up auto-application based on a trainable classifier that detects personal data. They also enable litigation hold for any ongoing GDPR disputes.