Microsoft Purview records management

Records management in Microsoft Purview is the structured way to declare specific content as a record — making it immutable, preserving it for a defined period, and disposing of it through a formal process. It's retention with teeth, designed for the kinds of compliance regimes where "we kept the document for 7 years" needs to be defensible in court.

What declaring a record does

When a retention label has the "Mark items as a record" setting and a user (or a policy) applies it:

• The item becomes immutable: no edits, no deletions, no renames.
• Some metadata is locked to the value at declaration.
• The label can only be removed by a user with the right privileges, and only to specific other labels.
• A disposition review can be required before final deletion at the end of retention.

A regulatory record is even stronger: once applied, the label cannot be removed by anyone (including admins), and content can never be unlocked.

The records management workflow

1. Define a file plan — a hierarchy of record categories with retention periods, triggers, and disposition rules. Purview's File Plan view lets you import a file plan from spreadsheet.
2. Publish retention labels mapped to record categories.
3. Apply labels — manually by users, or automatically by content match, machine-learning classifier, or trainable classifier.
4. Trigger retention — by content creation date, last-modified date, or event-based retention (e.g., a customer contract is closed; retention starts then).
5. Disposition review — at the end of retention, named reviewers approve deletion, extension, or relabel.
6. Audit trail — every record action is logged.

Event-based retention

A particularly useful capability: retention triggers from an event like contract closure, employee departure, or product end-of-life. The event is typically published by an external system (Dataverse, an HR system) via the Microsoft Graph. When the event fires, the timer on relevant records starts.

This means "retain for 7 years after the project ends" is enforceable, where a static creation-date trigger would fail.

Auto-application

To minimise reliance on user behaviour, labels can be auto-applied to content matching:

• Sensitive information types (regex + context).
• Trainable classifiers (ML categorisation).
• Keywords or properties (a SharePoint column value, a content type).

Auto-application is the practical way to apply records management at scale.

Licensing

Basic retention labels are included in Microsoft 365 E3. Records management — declaring records, event-based retention, disposition review — requires Microsoft 365 E5 or the Purview Records Management add-on.

When you need it

For industries with statutory record-keeping (finance, healthcare, public sector, legal, energy), records management is essential. For organisations with looser obligations, retention policies plus sensitivity labels are usually enough — records management adds operational overhead that needs to be justified.

When you do need it, document the file plan as carefully as you would any legal artefact. The whole point is defensibility, and undocumented decisions don't defend themselves.