Setting up Microsoft Purview retention policies and labels

Retention settings in Microsoft Purview stop content from being permanently deleted before a set period ends, and can delete it once that period is over. When a user deletes or edits retained content, Microsoft keeps a copy out of sight: for SharePoint and OneDrive it lands in the site's Preservation Hold library, and for Exchange and Teams it goes into hidden folders under Recoverable Items. Microsoft Learn's page "Learn about retention policies and retention labels" describes this behaviour in detail.

Backup is about getting a known-good state back after corruption, ransomware or a bad bulk change. Retention keeps individual items; it does not roll a site back to Tuesday. Archive is a storage and mailbox-size question. Most organizations need all three, and mixing them up is how a firm ends up with seven years of email it cannot restore quickly, or a backup that silently deletes records the law says to keep.

Purview offers two tools. Use policies for broad, location-wide rules and labels when different documents in the same place need different treatment.

• Where several settings apply, Microsoft's "principles of retention" decide the result: retention wins over deletion, the longest retention period wins, and an explicit label beats an implicit policy for deletion.
• Start with a small number of policies (for example, one for email, one for SharePoint and OneDrive, one for Teams) before you introduce labels.

Purview settings should come from a written records retention schedule, not the other way round. For each record class, write down the legal or business reason, the trigger (date created, last modified, end of fiscal year, or an event like an employee leaving), the period, and what happens at the end.

In Canada, the most common anchor is tax. The Canada Revenue Agency's guidance says that, generally, you must keep required records and supporting documents for six years from the end of the last tax year they relate to, and some records (such as certain corporate records) must be kept longer. Employment standards, professional regulators and contracts add their own periods. Collect those first; then decide which classes are broad enough for a policy and which need a label.

1. 01

   List record classes

   Financial, HR, client files, contracts, board records, general correspondence. Keep it to a page.

2. 02

   Attach a period and trigger to each

   Use the source of the requirement (statute, regulator, contract or business need) and record it beside the class.

3. 03

   Choose policy or label

   If everything in a location gets the same rule, use a policy. If one library holds mixed classes, use labels.

4. 04

   Decide end-of-period action

   Delete automatically, do nothing, or send for disposition review.

5. 05

   Pilot, then publish

   Test on a small group of sites and mailboxes before applying tenant-wide.

Each location behaves slightly differently. Exchange retention covers mailbox items and keeps deleted copies in Recoverable Items. SharePoint and OneDrive use the Preservation Hold library. Teams chats and channel messages are stored in Exchange mailboxes, and retained copies live in a hidden SubstrateHolds folder; Teams files are actually stored in SharePoint and OneDrive, so they follow those locations' settings.

Adaptive scopes let a policy target users or sites by attributes, such as department or job title in Microsoft Entra, and the membership is re-evaluated daily. Static scopes list specific mailboxes or sites. Adaptive scopes are useful when people move between teams; static scopes are simpler to audit in a small tenant.

A retention label can send items to a disposition review at the end of the period instead of deleting them silently. Reviewers see the items on the Disposition page in Records Management and approve deletion, extend retention or relabel. Microsoft notes that you need appropriate permissions and auditing must be enabled; a custom role group with only the Disposition Management role keeps reviewers away from other retention settings.

Use disposition review for records where a premature deletion would hurt: client files with possible claims, HR files, contracts. For low-value content, automatic deletion is fine and far less work.

• Turning on a short delete-only policy without checking for litigation or regulatory holds. Holds always win, but deletion of unheld content is permanent.
• Assuming retention replaces backup. It does not restore a whole site or mailbox to a point in time.
• Applying a tenant-wide policy before testing; large policies take time to propagate and are harder to unwind.
• Forgetting departing users: retention and holds decide whether a mailbox becomes inactive when the account is deleted.
• No owner for disposition. If nobody reviews, items pile up and the schedule is not followed.