Purview retention policies explained

A retention policy in Microsoft Purview keeps content for a defined period across one or more Microsoft 365 workloads, and optionally deletes it at the end. Used well, retention policies are the legal/regulatory keystone of a tenant; used poorly, they hide files where users can't find them.

The model

A retention policy has three things:

• Locations — Exchange mailboxes, SharePoint sites, OneDrive accounts, Microsoft 365 Groups, Skype, Teams chats, Teams channel messages, Teams meeting recordings, Viva Engage.
• Scope — which mailboxes / sites / users (static or adaptive).
• Actions:
  • Retain only — preserve for N years, then do nothing.
  • Retain then delete — preserve for N years, then delete.
  • Delete only — let users keep content as long as they want, but delete after N years.

The retention period starts from a trigger date — when the content was created, last modified, or labelled (depending on policy configuration).

How retention overrides user actions

When a retention policy applies to a location, content is preserved even if a user deletes it. For Exchange, deleted items move to a hidden preservation hold folder. For SharePoint and OneDrive, deleted items go to a hidden Preservation Hold Library. Users don't see preserved content but it counts against site / mailbox quota.

This is the most common surprise: "the site is full" and the reason turns out to be 200 GB of preserved-but-deleted content sitting invisibly in the preservation hold.

Adaptive vs static scope

• Static scope — manually pick the sites, users, or groups. Fine for small scopes.
• Adaptive scope — query-based, scoped by Entra ID attributes (department, country, group membership). Membership updates automatically.

Adaptive is the right default for any non-trivial tenant.

Retention labels vs retention policies

Two related but distinct features:

• Retention policies apply at the container level (mailbox, site).
• Retention labels apply at the individual item level.

Labels are richer: each label has its own retention period, can be triggered by content, and can be auto-applied. Use policies for the broad baseline and labels for specific records (contracts, HR files, financial records).

Order of precedence

When multiple retention settings apply, Microsoft uses a deterministic precedence:

1. Retention wins over deletion.
2. Longer retention wins.
3. Explicit wins over implicit.
4. Shorter deletion wins (once retention is satisfied).

This means a policy retaining for 7 years overrides a deletion policy at 3 years.

Licensing

Basic retention policies are included in Microsoft 365 E3. Adaptive scopes, advanced records management, and trainable classifiers for auto-labelling require E5 or specific Purview add-ons.

Practical advice

• Start with a single tenant-wide policy at a sensible default (3–7 years), then layer specific overrides.
• Always document the policy decision somewhere durable (a SharePoint site, your governance register).
• Monitor preservation hold size in OneDrive and SharePoint reports.
• Pair retention with sensitivity labels for end-to-end governance.

Retention is paperwork that protects the organisation. Set it once, review annually, document it forever.