Microsoft Purview Retention Policies for Email Compliance
Your organization needs to retain all email communications with customers for 7 years due to regulatory requirements. Which Microsoft Purview solution should you use?
Quick Answer
The answer is retention policies, as this Microsoft Purview solution is specifically designed to enforce retention periods for email communications to meet regulatory requirements. Retention policies allow administrators to define rules that retain data for a specified duration—such as seven years for customer emails—and then optionally delete it, ensuring compliance with legal or industry mandates. On the SC-900 exam, this concept tests your understanding of how Purview’s data lifecycle management tools map to common compliance scenarios, often appearing in questions that contrast retention with other solutions like DLP (which prevents data loss, not retention) or sensitivity labels (which classify but don’t enforce time-based holds). A common trap is confusing retention policies with eDiscovery, but remember: eDiscovery is for searching and exporting existing data, not for setting how long it stays. For a quick memory tip, think “retain with retention”—the name itself tells you the job.
⚠ Common exam trap
Test-takers frequently confuse retention policies (which enforce time-based preservation) with sensitivity labels (which focus on classification and protection), leading them to choose option A when the question explicitly requires a fixed retention duration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Retention policies
Retention policies in Microsoft Purview are designed to retain data for a specified period to meet regulatory or legal requirements. For email communications, a retention policy can be applied to Exchange mailboxes to ensure all messages are preserved for exactly 7 years, regardless of user deletion. This directly addresses the need to retain all customer emails for the mandated duration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sensitivity labels
Why it's wrong here
Sensitivity labels classify and protect content through encryption and visual markings, but they do not guarantee seven-year retention. Retention is handled by retention policies or retention labels, which can be combined with sensitivity labels. The confusion arises because both are Purview labelling features, yet only retention labels trigger preservation or deletion at end of period.
- ✗
eDiscovery (Standard)
Why it's wrong here
eDiscovery (Standard) supports identifying, holding and exporting content for litigation or investigations, using holds that persist while a case remains open. It does not apply a fixed seven-year retention schedule across all customer email. Retention policies are the mechanism for that requirement. eDiscovery is tempting because its holds preserve content, but they are case-scoped.
- ✓
Retention policies
Why this is correct
Retention policies in Microsoft Purview apply retention settings across Exchange mailboxes, satisfying the seven-year regulatory requirement without user intervention. Unlike retention labels, which target specific items, policies operate at workload or location level, automatically retaining all customer email communications for the defined period, then deleting them if configured.
- ✗
Data Loss Prevention policies
Why it's wrong here
DLP policies detect and block sensitive information in transit, such as preventing emails containing card numbers from being sent; they do not preserve items for a fixed period. Retention is enforced by retention policies and retention labels in Microsoft Purview. DLP is tempting because it also governs email content, but its purpose is prevention, not preservation.
Go deeper
Related to this question
Learn chapter
Session and Access Policies in Defender for Cloud Apps
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company needs to retain all customer emails for 7 years for regulatory compliance. After 7 years, they must be permanently deleted. They also need a legal hold for an ongoing investigation. Which Microsoft Purview solution should they use for the retention and deletion requirement?
medium- ✓ A.Data Lifecycle Management
- B.Records Management
- C.Compliance Manager
- D.eDiscovery
Why A: Data Lifecycle Management (DLM) in Microsoft Purview is the correct solution because it allows you to define retention policies that automatically retain customer emails for a specified period (7 years) and then permanently delete them. This directly addresses the regulatory compliance requirement for retention and deletion without manual intervention.
Variation 2. A company uses Microsoft 365. The compliance department requires that all financial documents be retained for 10 years and then automatically deleted, while marketing documents must be retained for 3 years and then deleted. Additionally, they want to apply a default retention policy to all SharePoint Online sites. Which Microsoft Purview solution should the company use?
easy- ✓ A.Microsoft Purview Data Lifecycle Management
- B.Microsoft Purview eDiscovery
- C.Microsoft Purview Compliance Manager
- D.Microsoft Purview Data Loss Prevention (DLP)
Why A: Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it allows organizations to define retention and deletion policies based on content type and location. In this scenario, the company needs to apply different retention periods (10 years for financial documents, 3 years for marketing documents) and a default retention policy for all SharePoint Online sites, which is exactly what Data Lifecycle Management's retention policies and labels provide.
Variation 3. A company must retain all customer contracts for 10 years to comply with industry regulations. After 10 years, the contracts must be permanently deleted. Which Microsoft Purview solution should be used to automate this process?
medium- A.Data Loss Prevention (DLP)
- ✓ B.Data Lifecycle Management
- C.eDiscovery
- D.Information Protection
Why B: Data Lifecycle Management (DLM) in Microsoft Purview is the correct solution because it allows you to define retention labels and policies that automatically retain contracts for a specified period (10 years) and then trigger a permanent deletion disposition review or direct deletion. This aligns directly with the regulatory requirement to retain data for a fixed duration and then dispose of it securely.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.