Week 8, Day 1 — Retention Policies

Week 7 close & the missing governance layer

• Ask: "The Week 7 incident involved Payroll-Q4.docx being shared externally. You found it and revoked the link. A week later, Priya Nair decides to permanently delete Payroll-Q4.docx from SharePoint because she thinks it's outdated. If that file is part of a legal hold or regulatory requirement, can she delete it?" — answer: without a retention policy, yes. A user with delete permission can delete files permanently. Retention policies change that.
• Ask: "In Lab 4-D you configured OneDrive storage quota and discussed the 180-day recording expiry. Where did you configure the OneDrive retention period?" — directly in the OneDrive admin centre as a workload setting. That's a single-service ad-hoc setting. Today you learn the proper way: Purview retention policies that apply across all workloads simultaneously and override individual settings.
• Frame: retention is the legal foundation underneath everything else. Security controls protect data while it's in use. Retention policies ensure it exists (and cannot be prematurely deleted) when you need it for legal, regulatory, or HR purposes — and that it is automatically deleted when you don't, to reduce liability. Both ends of the retention lifecycle matter.

Retention policies — the model, the mechanics, and the Preservation Library

What retention policies do to content — the lifecycle

• The Preservation Library — when a retention policy covers a SharePoint site and a user deletes a file that is within its retention period, SharePoint silently copies the file to a hidden system library called the Preservation Hold Library before completing the delete. From the user's perspective, the file is gone. From the compliance perspective, it is preserved and discoverable via eDiscovery. The user never knows the copy exists. This is the mechanism that makes retention work — deletion does not mean destruction.
• Retain only vs retain then delete vs delete only — three retention actions. Retain only: keep content for the period, do nothing at the end (default for most enterprise policies). Retain then delete: keep for the period, then automatically delete (used for data that must be purged — e.g. GDPR data minimisation). Delete only: delete content that is older than the period without any retention (used for cleanup of old data not subject to retention requirements).
• Static vs adaptive policy scopes — static scope: you explicitly specify which locations are covered (e.g. specific SharePoint sites, specific user mailboxes). Adaptive scope: a dynamic query that automatically includes matching locations (e.g. all mailboxes where Department = Finance). Adaptive scopes are more powerful for large organisations — they automatically include new users who match the query without requiring policy updates.
• Retention period triggers — three options for when the retention clock starts. When item was created (most common — retention starts from creation date). When item was last modified (used for content that evolves — the clock resets on each edit). When a label event occurs (event-based retention — used for contract start/end dates, employee departure, product discontinuation). Events are triggered manually or via Power Automate.
• Retention wins over deletion — when a retention policy and a deletion action conflict, retention always wins. A user cannot permanently delete content that is within a retention period. An admin cannot either, unless they modify or remove the policy. This is the legally significant guarantee that retention policies provide.
• Retention labels vs retention policies — retention policies apply automatically to entire workloads or locations. Retention labels are applied to individual items (manually or via auto-labelling) and can start event-based retention. A retention label on a specific contract document starts its 7-year retention clock when the contract is signed — a policy cannot do this per-item granularity.

Lab 8-A: Retention policies for Exchange, SharePoint/OneDrive, and Teams

Students create three retention policies covering all Lakeview Logistics workloads, test the Preservation Library by deleting and verifying preservation of a Finance document, configure a retention label for contracts, and review the compliance portal retention status.

• Step 1 — Review existing workload retention settings (5 min)
  Before creating Purview retention policies, note the existing ad-hoc settings:
  · OneDrive: SharePoint admin centre → Settings → OneDrive retention. Note the current period (this was set in Week 4 or left at default).
  · Teams meeting recordings: Intune meeting policy — recording expiry 120 days (set in Lab 5-D).
  These will be superseded by Purview policies. Record both values.
• Step 2 — Create the Exchange email retention policy (15 min)
  Navigate to purview.microsoft.com → Data lifecycle management → Retention policies → + New retention policy.
  · Name: LL — Email Retention 3 Years
  · Scope: Static
  · Locations: Exchange mailboxes — All (all 10 Lakeview Logistics users)
  · Retention setting: Retain items for a specific period → 3 years → Start the retention period based on: When items were created
  · At end of retention period: Delete items automatically
  Save. This means every email in every Lakeview Logistics mailbox is retained for 3 years and then automatically purged.
• Step 3 — Create the SharePoint and OneDrive retention policy (15 min)
  Create a second retention policy.
  · Name: LL — Document Retention 5 Years
  · Locations: SharePoint sites (All sites) + OneDrive accounts (All accounts)
  · Retention setting: Retain items for 5 years → based on: When items were created
  · At end of period: Delete items automatically
  Save.
  Note on Lab 4-D: This policy supersedes the OneDrive storage retention setting configured in the SharePoint admin centre. Purview retention takes precedence.
• Step 4 — Create the Teams messages retention policy (10 min)
  Create a third retention policy.
  · Name: LL — Teams Messages Retention 1 Year
  · Locations: Teams channel messages (All teams) + Teams chats and Copilot interactions (All users)
  · Retention setting: Retain items for 1 year → based on: When items were created
  · At end of period: Delete items automatically
  Save.
• Step 5 — Test the Preservation Library (15 min)
  Navigate to the Finance SharePoint site.
  Upload a test file to the document library: create a Word document named Retention-Test.docx with a few lines of text. Upload it.
  Wait 2 minutes (for the retention policy to index the file).
  Delete Retention-Test.docx from the document library. Also empty the SharePoint Recycle Bin (Site settings → Recycle Bin → Empty).
  Now navigate to the Preservation Hold Library: append /_layouts/15/AdminRecycleBin.aspx to the site URL, or navigate to Site contents → show hidden libraries → Preservation Hold Library.
  Confirm Retention-Test.docx appears in the Preservation Hold Library — preserved despite being "permanently" deleted.
• Step 6 — Create a retention label for Finance contracts (10 min)
  Navigate to purview.microsoft.com → Data lifecycle management → Retention labels → + Create a label.
  · Name: LL — Finance Contract 7 Years
  · Retention period: 7 years
  · Start the period: When items were created
  · At end of period: Trigger a disposition review (a compliance officer reviews before permanent deletion)
  Publish the label in a label policy targeting the Finance team. This label can then be manually applied to individual contract documents in the Finance SharePoint library — giving those specific documents a longer retention period than the site-wide 5-year policy.

⭐ Bonus: Adaptive policy scope and retention label auto-application

Reflection & preview

• Ask: "Priya Nair's Finance Contract 7 Years label is on a contract document. The LL — Document Retention 5 Years policy also covers the Finance SharePoint site. After 5 years, the policy tries to delete the contract. What happens?" — the retention label wins. When a retention policy and a retention label both apply to the same item, the longer retention period always wins. The contract stays for 7 years, not 5.
• Ask: "A disgruntled employee deliberately deletes 500 emails before leaving. The LL — Email Retention 3 Years policy is in place. Are those emails lost?" — no. Purview copies deleted content to the Recoverable Items folder before completing the delete. The emails are preserved and discoverable via eDiscovery — which is exactly what Day 2 covers.
• Preview Day 2: those 500 preserved emails need to be found and exported for a legal request. eDiscovery — creating a case, placing mailboxes on legal hold, searching across all workloads, and exporting a production-ready evidence package.