How to create a retention policy in Microsoft Purview

Creating a retention policy in Microsoft Purview is a wizard — name, scope type, locations, retention settings, review — that ends with a rule applied automatically to every mailbox, site, or chat in scope. The decisions that matter are made before the wizard: what period, whether to delete at the end of it, and whether the policy covers everything (static) or a population defined by attributes (adaptive). Get those wrong and you either keep data forever or delete it on a schedule nobody agreed to.

The concepts — retain vs delete, the principles of retention when policies overlap, labels vs policies, and how holds interact — are in Purview retention policies explained; records and disposition in Purview records management. This page is the build for the most common case: a baseline retain-then-delete policy.

Prerequisites

• Compliance Administrator or Records Management role group in Purview. Global Admin works but should not be used for routine compliance work.
• Licensing: retention policies for Exchange, SharePoint, OneDrive, and Microsoft 365 Groups are in Microsoft 365 E3/Business Premium and up (via Exchange Online Plan 2 / SharePoint Plan 2). Teams retention and adaptive scopes need E5 / E5 Compliance (or Office 365 E5 for Teams). Check before you promise.
• A written retention schedule signed off by legal or records management: locations, period, and the retain/delete decision. The policy is not the place to decide this.
• For adaptive scopes: the user or site attributes populated (department, country, site property bag) that the scope will query.

Steps

1. Create the policy

Purview portal → Solutions → Data lifecycle management → Microsoft 365 → Retention policies → New retention policy. Name it descriptively: RET-Exchange-SharePoint-7y-RetainDelete. The description is where you cite the schedule and the approval.

2. Choose the scope type

Static applies to whole locations, optionally with includes/excludes per location. Adaptive applies to an adaptive scope you define first (Data lifecycle management → Adaptive scopes): a query over users, groups, or sites — Department -eq "Finance", or sites with a custom property. Adaptive scopes have no per-location item limits and follow the population as it changes; use them when different departments or regions have different periods. Static is fine for one tenant-wide baseline.

3. Select locations

For a tenant baseline: Exchange mailboxes, SharePoint classic and communication sites, OneDrive accounts, Microsoft 365 Group mailboxes & sites. Leave Teams off — it needs its own policy (FAQ). Exclude specific sites or mailboxes here only for documented reasons; a large exclusion list is a sign you wanted an adaptive scope.

4. Set retention

Retain items for a specific period → the schedule's period (7 years is common for business records; 3 for general correspondence). Start the retention period based on: When items were created for a simple baseline, or When items were last modified if the schedule says so. At the end of the retention period: Delete items automatically — or Do nothing if the schedule is retain-only. The retain-only option is what most tenants pick first and then regret when storage and eDiscovery scope balloon; if legal agreed a period, delete at the end of it.

Do not pick Only delete items when they reach a certain age unless the intent really is a deletion-only policy with no preservation — that option deletes without retaining.

5. Review and submit

The summary shows every location and setting. Submit. The policy shows On (Pending) while it distributes; SharePoint and OneDrive take up to a day, Exchange up to a week for full coverage.

6. Add the Teams policy

Repeat with locations Teams channel messages and Teams chats (and Teams private channel messages if you use them), typically with a shorter period. Chat retention is where users notice, so read Teams chat retention and policies before choosing a short deletion period.

Verify

• Retention policies list shows On (Success) for the policy. With PowerShell: Connect-IPPSSession; Get-RetentionCompliancePolicy -DistributionDetail | fl Name,DistributionStatus.
• In a SharePoint site in scope, Site contents → Preservation Hold Library appears after the first deletion or edit of a covered file (it is hidden until needed).
• Delete a test item as a user, wait, and confirm it is discoverable via a Content search in eDiscovery.
• Check for conflicts: if a shorter policy and a longer one overlap, the longer retention wins and the earlier deletion is blocked — by design, per the principles of retention.

Roll back

Turn the policy off (Edit → Turn off) rather than deleting it: an off policy stops applying retention, but content already in Preservation Hold or Recoverable Items stays until its period expires or the policy is deleted. Deleting a policy releases preserved content for normal deletion after the standard grace period, which for a retain-only policy might be exactly the outcome you do not want. If the policy contains Delete and the period was wrong, turn it off immediately — deletion runs on a timer job, and content past the period is purged on the next pass. If a policy has Preservation Lock enabled, it cannot be turned off or shortened at all; that switch exists for regulatory records and should never be set casually.