Data Retention and Records Management with Microsoft Purview

What this guide covers

Retention is the Purview pillar people put off, because nothing visibly breaks when you ignore it. It stays quiet right up until legal asks why a mailbox was emptied, or a regulator asks for seven years of records you can no longer produce, and then it is an incident.

The pitch is simple: keep this for seven years, then delete it. Underneath, it is anything but. Retention labels behave differently from retention policies. Adaptive scopes target different surfaces than static ones. A Preservation Hold library quietly eats site quota. Records carry one-way doors you cannot reverse, and four principles of precedence decide which rule wins when policies and labels collide. Microsoft documents each of these pieces well and in a different place, and never assembles them into the one account you need before you turn a policy loose on live data.

This book is that assembled account. It walks data lifecycle and records management end to end, from the mental model and the licensing that gates it, through a trial-tenant build, labels, policies, scopes, records, and disposition, into how precedence resolves and the failure modes you meet only after a policy has run long enough to delete something. Every limit, license boundary, and portal path is grounded against current Microsoft Learn and validated in a live Microsoft 365 E5 lab. You do not need a production tenant to follow along; a trial and a willingness to provision it are enough.

Chapter map

1. What Retention Actually Does (and Doesn't)
2. Licensing and Prerequisites
3. Retention Labels vs. Retention Policies
4. Building Retention Policies: Static and Adaptive Scopes
5. Retention Labels and Auto-Apply
6. Records Management: Declaring Records, Disposition, and the File Plan
7. Retention Across the Workloads: Exchange, SharePoint, OneDrive, and Teams
8. Policy Precedence and the Principles of Retention
9. Disposition Review, Recovery, and End of Life
10. Operational Reality: Timing, Gotchas, and Troubleshooting

Appendices: PowerShell for Retention; Microsoft Learn Bibliography; Records and Retention Readiness Checklist; Standing Up a Trial Tenant for Data Lifecycle Management.

Who it is for

This is for the security engineer, consultant, or Microsoft 365 administrator who inherited "set up retention" as a project line and wants one document that connects the pieces the official docs scatter, alongside the records managers and compliance stakeholders who own the retention schedule the system enforces and need to trust what it does, and it maps directly to the retention and data lifecycle depth expected on SC-401, Administering Information Security in Microsoft 365, while the records management chapters take you past what that exam measures.

See where you are

7 questions from this guide's territory (3 easy, 4 medium), with the explanation after each. Nothing is stored and nothing is sent anywhere.

The rest of Microsoft Purview Field Guides

One product per book, a lab appendix in every one, and a companion page like this one for each.

• 
  Field guide

  Audit, Alerts, and Investigation with Microsoft Purview

  The what-happened ticket arrives with a deadline, and the event you need aged out of the audit log months ago. The investigation surface, in the order you use it.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Communication Compliance with Microsoft Purview

  One Microsoft Purview tool reads your employees' messages, inspecting Teams, Exchange, Viva Engage, Copilot prompts, and connected third-party sources for harassment, threats, and regulatory violations.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Data Loss Prevention with Microsoft Purview

  Turn on Microsoft Purview DLP the way the wizard suggests and you get one of two outcomes: a wall of false positives nobody reads, or a policy so timid it protects nothing.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  eDiscovery and Legal Holds with Microsoft Purview

  When legal hands you a hold notice, the clock is real and the stakes include sanctions. Holds preserve and searches collect, so a matter you searched but never held can quietly lose data before anyone notices.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Insider Risk Management with Microsoft Purview

  There is no button that blocks the leak.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Sensitivity Labels and Data Classification with Microsoft Purview

  Classify your data once and the protection travels everywhere. That is the pitch.

  Kindle$12.99Get it on AmazonCompanion page

The hard set (2 questions)

The hardest SC-401 questions this guide publishes, none of them repeated from the placement quiz above: the answer first, why every other option is wrong, and the Microsoft Learn page behind it. The practice book for this exam holds the full bank.

Content in a SharePoint site has had its retention period expire. The compliance team wants to permanently delete it as quickly as possible. They run the retention policy delete action, wait 15 days, then check and the content is gone from the main library but still showing up in a site collection admin's Recycle Bin view. Why, and what is the correct expectation?

Correct answer: B. After the Preservation Hold library cleanup phase (up to 37 days), expired content moves to the second-stage Recycle Bin, not immediate permanent deletion. A single 93-day window spans both stages before permanent deletion. The content being visible at day 15 is expected.

Microsoft no longer hard-deletes content directly from the Preservation Hold library. Instead, expired content moves to the second-stage Recycle Bin to prevent accidental loss, where it waits for the remainder of a 93-day window that spans both first- and second-stage bins. At day 15, if cleanup has just processed the PHL (and the content sat there 30+ days), it would only now be arriving in the second-stage Recycle Bin. The 93-day window is still running. This is expected and not a bug. The content is not searchable by eDiscovery while in the Recycle Bin because it is not indexed there.

Why the other options are wrong:

• A. Content in the Recycle Bin is not indexed, so eDiscovery searches cannot find it and cannot place it on a new hold. This is a hard limitation of the Recycle Bin: it is outside the searchable index.
• C. The second-stage Recycle Bin is not a system copy separate from retention cleanup. It is part of the documented deletion path for expired retention content. Manual admin emptying would break the 93-day safety window.
• D. If no new policy was applied, nothing would reinitiate a hold on the expired content. The scenario describes standard post-expiry behavior, not a new hold.

Memory hook: 93-day window = both Recycle Bin stages combined. Content goes from the PHL to the second-stage bin (not hard-delete). Bin content is unindexed, so eDiscovery can't hold it.

Microsoft Learn: Retention policies SharePoint

You create an adaptive user scope with the attribute Country or region 'is equal to' Europe. Your users have values such as France, Germany, and Spain in that attribute. After a day, the scope shows zero members. What is the most likely cause?

Correct answer: C. The query matches the literal attribute value, and because it runs only once daily with no validation of what you typed, 'Europe' never matches the actual country values stored on the accounts

Adaptive scope queries run once daily against Entra ID and match the exact attribute value you specify. Because the query doesn't run immediately, there's no validation that you typed a valid value. 'Europe' is not a value stored in the Country or region attribute (accounts hold specific countries like France), so nothing matches. You'd use grouped country values or an advanced OPATH query instead.

Why the other options are wrong:

• A. Adaptive user scopes read Entra ID attributes (name, department, country, custom attributes, etc.); SharePoint properties apply only to the SharePoint sites scope type.
• B. There is no Start-AdaptiveScope cmdlet; you view membership with Get-AdaptiveScopeMembers, and the query runs automatically each day.
• D. Administrative units are optional; the default Full directory works fine, so a missing admin unit isn't the cause.

Memory hook: Adaptive scopes match literal values, run daily, and never validate your typo.

Microsoft Learn: Purview adaptive scopes