Describe the capabilities of Microsoft compliance solutions →hardMultiple ChoiceObjective-mapped

Microsoft Purview Retention Policy Behavior Without Preservation Lock

Exhibit

{
  "PolicyName": "GDPR Data Retention",
  "Locations": [
    "ExchangeOnline",
    "SharePointOnline",
    "OneDriveForBusiness"
  ],
  "RetentionSettings": {
    "RetentionDuration": 365,
    "RetentionTrigger": "WhenCreated",
    "RetentionAction": "Delete",
    "PreservationLock": false
  }
}

Refer to the exhibit. You are evaluating a Microsoft Purview retention policy. The policy is applied to Exchange Online, SharePoint Online, and OneDrive for Business. What is the behavior of this policy?

Quick Answer

The correct behavior is that items are automatically deleted 365 days after creation. This outcome occurs because the retention policy is configured to retain content for one year from the date it was created, and without preservation lock, the system enforces that retention period but does not prevent users from manually deleting items earlier—though any such deletion is overridden by the policy, which holds the data until the 365-day mark. On the SC-900 exam, this scenario tests your understanding of how retention policies function when preservation lock is not applied, a common trap being the assumption that users can permanently remove items before the retention period ends. Remember that without preservation lock, the policy is mutable and user deletions are allowed but ineffective; the system still retains and then deletes automatically. A helpful memory tip: “No lock, no block—users can delete, but the clock still ticks to the delete.”

⚠ Common exam trap

Many exam-takers confuse the 'last modification' trigger with the 'creation date' trigger, or assume a retention policy always preserves items before deletion, when in fact a delete-only policy immediately purges items after the specified age without any retention period.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Items are automatically deleted 365 days after creation

The retention policy shown in the exhibit specifies 'Delete items automatically after 365 days from creation date.' This means that once an item reaches 365 days from its creation date (not last modification), it will be permanently deleted from Exchange Online, SharePoint Online, and OneDrive for Business. The policy does not include a retention period to preserve items; it only deletes them after the specified age.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Items are retained indefinitely and cannot be deleted
Why it's wrong here
The policy has a retention duration of 365 days, not indefinite.
✗
Items are deleted 365 days after last modification
Why it's wrong here
RetentionTrigger is WhenCreated, not last modification.
✗
Items are preserved with a lock and cannot be deleted by users
Why it's wrong here
PreservationLock is false, so users can delete items before the period ends.
✓
Items are automatically deleted 365 days after creation
Why this is correct
RetentionDuration is 365, trigger is WhenCreated, action is Delete.

Go deeper

1 more way this is tested on SC-900

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. The JSON shows a Microsoft Purview retention policy configuration. After applying this policy, an administrator notices that emails in user mailboxes older than one year are being permanently deleted instead of being retained. Which setting should the administrator check first to resolve this issue?

hard

✓ A.The 'RetentionType' is set to 'KeepAndDelete', which deletes after retention period.
B.The 'Locations' array does not include all necessary workloads.
C.The 'RetentionDuration' is too short for email retention.
D.The 'RetentionTrigger' should be 'When items were last modified' instead of 'created'.

Why A: The 'KeepAndDelete' retention type retains items for the specified duration and then permanently deletes them. In this scenario, emails older than one year are deleted after the 365-day retention period expires. Checking the 'RetentionType' setting is the first step to identify why emails are being deleted instead of retained. Option B is incorrect because the 'Locations' array includes all necessary workloads (Exchange, SharePoint, OneDrive). The issue is not related to missing workloads. Option C is incorrect because the 'RetentionDuration' of 365 days is appropriate for a one-year retention policy. The problem is the retention type, not the duration. Option D is incorrect because the 'RetentionTrigger' set to 'When items were created' is standard for email retention. Changing it to 'last modified' would not prevent deletion; the deletion occurs due to the 'KeepAndDelete' type, not the trigger.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.

Microsoft Purview Retention Policy Behavior Without Preservation Lock

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on SC-900