The retention of records in Exchange Online (EXO), SharePoint Online (SPO), OneDrive for Business (ODfB) and Office 365 (O365) groups can be achieved through the application of retention labels published in the O365 Security and Compliance admin portal.
This post describes:
- How retention labels work (in summary), including the ‘per record’ rather than the container/aggregation retention model.
- What happens to content in Office 365 when a retention period expires.
- The options and actions that may influence the way retention labels/policies are configured, where and how they are applied, and the outcomes required.
The post highlights the need for information and records managers to be involved in all aspects of governance, site architecture and design, and decisions around specific settings and configuration, as well as being assigned specific roles, when Office 365 is implemented.
A quick summary of how O365 retention labels work
Records retention policies in O365 are based on ‘retention labels’ that are created in the O365 Security and Compliance admin portal under the ‘Classifications’ section. Multiple labels can be applied to a single policy.
- Click this link to read Microsoft’s detailed guidance on retention labels.
- Click this link to read Microsoft’s detailed guidance on retention policies.
Retention outcomes
Each retention label defines one of three potential outcomes at the end of the retention period, if retention is enabled, ‘keep forever’ is not selected, and the label is not used to classify the content as a record*:
- The content will be automatically deleted. If the content is in SharePoint, it will first be sent to the Recycle Bin, from which it can be recovered within 90 days.
- This option may be suitable for certain types of low value records.
- A disposition review will be triggered to notify specific people. As with the previous point, SharePoint content will be sent to the Recycle Bin if a decision is made to delete it.
- This option will require additional, human-intervention actions, as described below, if standard records management disposal review processes are followed.
- Nothing.
Triggers
The date when the above action will occur is based on one of four triggers:
- Date created
- Date last modified
- When labelled applied
- A event. The ‘out of the box’ (OOTB) event types are:
- Employee activity. (Processes related to hiring, performance and termination of an employee)
- Expiration or termination of contracts and agreements.
- Product lifetime. (Processes relating to last manufacturing date of products).
- A new event can also be added.
- See this post for Microsoft guidance on event-driven retention.
An additional alternative option is available: ‘Don’t retain the content, just delete it if it’s older than n days/months/years.’ This is similar to the automatic deletion option above and may be suitable for certain types of records.
Declaring content as records
* The option to classify or ‘declare’ content as a record is not discussed further as relates to the way records are managed in the US. Microsoft’s guidance on labels notes that: ‘At a high level, records management means that: (a) Important content is classified as a record by users. (b) A record can’t be modified or deleted. (c) Records are finally disposed of after their stated lifetime is past.’ The standard on records management, ISO 15489, defines a record as ‘evidence of business activities, often (but not exclusively) in the form of a document or object, in any form’. This means that anything can be a record. The record may continue to be modified throughout its life.
When do retention labels become active?
Retention labels become active only when they are published. As part of the publishing process, a decision must be made if the label will apply to all (a single option) or selected parts of the O365 ecosystem:
- The Exchange Online (EXO) mailboxes of all or specific recipients, or excluding specific recipients.
- All or specific SharePoint Online (SPO) sites, or excluding specific sites.
- All or specific OneDrive for Business (ODfB) accounts, or excluding specific accounts.
- All or specific O365 Groups, or excluding specific groups. Note that content in Microsoft Teams (MS Teams) is included in the O365 Groups options that include both the SharePoint content and email/Teams chat content.
Auto-applying retention labels
Both the retention label and policy sections include the ability to auto-apply a retention policy if certain conditions are met.
- Sensitive information types. These are the same types that appear in the Data Loss Prevention (DLP) section, for example ‘Financial data’ or ‘Privacy data’.
- Specific keywords.
- Content types and metadata (E5 licences only). See this post by Joanne Klein for a description of these options.
The ability of the first two options to accurately identify content and apply a retention policy should be investigated before they are relied on.
When do retention policies start working
According to Microsoft’s guidance Overview of Retention Labels:
If you publish retention labels to SharePoint or OneDrive, it can take one day for those retention labels to appear for end users. In addition, if you publish retention labels to Exchange, it can take 7 days for those retention labels to appear for end users, and the mailbox needs to contain at least 10 MB of data.
- In EXO, the default MRM policy needs to be removed before the new policy applies.
- In ODfB, the policy is available to be manually applied on folders or documents. It does not automatically apply to content.
- In SPO, the policy can be applied to document libraries or documents. To avoid removing the ability for users to legitimately need to delete documents in an active library it is recommended to apply the policy after the document library has ceased to be active.
- Content in Office 365 Groups is covered by either the EXO (for email/teams chat content) or the SPO policy (applied to libraries).
Retention labels apply to individual records within aggregations
Records labels can be applied to aggregations of records (an entire email mailbox or folder, a SharePoint library or list, an ODfB account, O365 Groups) or individual records. However, the disposal process targets individual records (e.g., individual emails, single documents in SharePoint libraries, individual list items).
That is, even when all the individual records are disposed of, the parent aggregation remains in place without any indication that the records previously stored in it (sometimes known as a ‘stub’) have been destroyed.
This outcome has implications for the way the outcome of a retention label is set. It requires a choice between (a) delete automatically without review or (b) review before delete.
The latter option is made complicated by the requirement to review individual documents, including potentially in the original container (document library in SPO) and export metadata relating to those records if a record of the deletion is to be retained.
What happens when records reach the end of their retention period
As noted above, the outcome at the end of the retention period (trigger date + n days/months/years) will depend on the settings on the label.
- Where the label was applied (EXO mailbox, SPO library or list, ODfB folder or document, O365 Group)
- Whether the records would be deleted automatically or be subject to a disposition review.
If the records are to be deleted automatically:
- SPO and ODfB records will be sent to the site/ODfB Recycle Bin for 90 days
- EXO emails will be moved to a ‘Cleanup’ area for 14 days, before permanent deletion.
- Aside from the audit logs (which by default only go back 90 days), no other record will be kept of the destroyed records.
If the records are subject to a disposition review, an email is sent to the person nominated. When that person clicks on the link in the email they are taken directly to the ‘Dispositions’ sub-section of the Records Management section of the O365 Security and Compliance centre.
It is arguable that retention policies with disposition review should not be applied to ODfB content as this will require the reviewer to review all the content that has been labelled by a user in their ODfB account.
- For more information about this subject see this Microsoft page ‘Overview of disposition reviews‘. Microsoft note, on that page ‘To get access to the Disposition page, reviewers must be members of the Disposition Management role and the View-Only Audit Logs role. We recommend creating a new role group called Disposition Reviewers, adding these two roles to that role group, and then adding members to the role group.’
The dispositions dashboard shows the number of records that are pending disposition against each retention policy label:
Pending disposition tab
When the reviewer clicks on one of the retention policies listed, the following view opens for records ‘Pending disposition’:
An important point to note here is that records are listed individually, not in logical aggregations or collections. It is possible however to use the Search option on the left to filter by author (emails) or SharePoint site and/or site library. It is also possible to export the details (which does not include any unique metadata applied to documents in SharePoint libraries).
All the records displayed may then be selected and a ‘Finalise decision’ dialogue box appears with the following options:
- Dispose of the records.
- Extend the retention.
- Re-label the records.
Disposed items tab
The Dispositions dashboard includes a ‘Disposed items’ tab.
Microsoft note that this tab ‘… shows dispositions [that] were approved for deletion during a disposition review and are now in the process of being permanently deleted. Items that had a different retention label applied or their retention period extended as part of a review won’t appear here.’
Importantly, once records are permanently deleted, they no longer appear in the ‘Disposed Items’ tab. This means that no record will be kept of the records that were destroyed.
Shortcomings of the O365 dispositions/disposal model for records stored in SPO
Only individual records appear, not all the items in a document library
If the retention outcome is based on the ‘created’ or ‘last modified’ date, individual records in SPO document libraries will start to appear as soon as they reach the retention end date. The reviewer may need (or want) to view the original library, which they can identify from the link is in the dispositions review pane.
Retention policies prevent deletion
As a retention label prevents the deletion of content by users, and this may put them off using SharePoint, it is recommended that retention in SPO document libraries be based on when the label was applied NOT when it was created or last modified. This will help to ensure that all documents appear in the disposition review area at the same time.
Event based triggers may not be suitable for disposition review
If the retention outcome is based on an event, or is auto applied and a disposition review is required, those records will appear randomly when the event is triggered. It could be difficult for records managers to decide the disposal outcome in this way without referring back to the library.
The dispositions review pane does not display the original metadata
The dispositions review pane displays only very basic metadata from the original library. Again, the reviewer may need to view the original library, export the metadata and store that in a secure location. Note that the exported metadata includes the URL of each original record including the library name.
The document library remains even when all contained records are destroyed
If the reviewer chooses to dispose of the records listed, only the content of the library (the individual documents stored in it) is deleted, not the actual library itself. No record (e.g., a ‘stub’ of the deleted item) is kept in the library of the deleted content.
The ‘Disposed items’ tab only shows records being destroyed
The ‘Disposed items’ tab only shows records in the process of being destroyed. It does not keep a record of what was destroyed. Records managers will need to retain the metadata of what was destroyed, when, based on what disposal authority, and with whose approval.
Dispositions really only provides a ‘heads up’ for further action
The Dispositions process may be instead used as a form of ‘heads up’ that records are starting to be due for disposal in a document library. This would allow the records managers (who should be Site Collection administrators) to review the library, export the complete set of metadata, and decide if the entire library can be deleted since it is no longer required.
Conclusions
Retention labels in O365 are an effective way of managing the retention and disposal of records in that environment, subject to the following points.
Emails will likely continue to be managed as complete aggregations of records – the mailbox. Users cannot be expected to create logical groupings and apply individual retention labels to those records.
Organisational records policies may mandate specific timeframes for the retention of email (e.g., 1 year), while HR/IT security policies may mandate that whole mailboxes are retained for a period of time after employees leave. It is important to understand the difference between these two models
Options to automatically transfer emails to SharePoint document libraries via rules may be possible using Flow but these rely on individual users to set up.
Consideration should instead be given to using O365 Group mailboxes, rather than individual personal mailboxes, for specific work related matters. For example, ‘Customer Complaints’, or ‘XYZ Project’.
OneDrive for Business Accounts
ODfB accounts may be covered by two forms of retention:
- Retention labels that apply to all ODfB accounts while the account is active. These must be manually applied by users.
- A separate retention period set for ODfB accounts after a user leaves the organisation.
If there is a requirement to prevent the deletion of content by a user from their ODfB account, the better way to achieve this is using an eDiscovery case with Legal Hold applied.
SharePoint Online
As most records will be stored in SharePoint document libraries (including Office 365 Group-based SP libraries), multiple retention labels will be required to address different types of content or retention requirements.
Careful consideration should be given to whether records can be deleted automatically at the end of the retention period or should be subject to disposition review, noting that the automatic deletion provides no opportunity to capture the metadata of the records.
The ‘auto-apply’ or event-based retention option should be used sparingly to avoid a trickle of records for disposal – unless there is enough trust that these can be accurately marked and deleted without review.
Shortcomings in the disposition review process support the following decisions for SharePoint Online content:
- The number of retention labels should be minimised to avoid a very long drop-down menu when a label is applied. If current record retention or disposal authorities contain a lot of classes, some of these could potential be combined into a single class (e.g., ‘Company Records – 7 years’), while the site name and document library name should provide some context to the content to ‘map’ back to the original classes.
- Retention labels should be applied when document libraries (or lists) become inactive as this will avoid conflict with users who want to delete content and also ensure that documents are ready for disposition review at the same time.
- Retention labels applied to SPO document libraries should include the disposition review option unless a ‘delete only’ label is considered suitable for certain document libraries that clearly contain working documents or Redundant, Outdated and Trivial (ROT) content.
- Records managers should review the content of all or most original SPO document libraries, and export the metadata of those libraries for storage in a separate location (such as an ‘archives’ site), or in the original library with the retention label changed to ‘Never Delete’. The original document library can then be deleted.
Records about the world 