UPDATE – I have added a third option, by creating an Office 365 retention policy (not linked with a label) and applying to a specific site. I am indebted to Francis Laurin (@pzkfwg) and Joanne Klein (@JoanneCKlein) for their feedback and additional comments on the Office 365 retention policy option.
There are three main ways to apply a records retention policy in SharePoint Online:
- Applying an Office 365 retention policy to a SharePoint site directly. When applied, the policy applies to all libraries and lists on the site, not the actual site itself (that is, it does not delete the site).
- Creating a retention label, publishing it as a retention policy, and applying it to individual SharePoint libraries or lists.
- As a site policy, applied to the entire site.
This post describes how to create and apply a ‘legacy’ retention policy to a SharePoint Online site, when and why these may be used, and a word of caution about their use.
What is a site policy?
A SharePoint site policy is an option, enabled as a feature on each site, that allows the SharePoint site to be closed (made read only) and then deleted on a given date, with advance notifications.
How is a site policy enabled?
The SharePoint site policy feature is enabled in Site Settings – Site Collection Administration – Site collection features.
When the feature is activated, two new and related options appear in the Site Settings:
- Site policies in the Site Collection Administration section. This is where the site policy is created and is only visible to Site Collection Administrators (SCAs).
- Site Closure and Deletion in the Site Administration section’. This is where the site policy is added and enabled. It is visible to both SCAs and Site Owners.
Only SCAs can enable the feature and create a site policy, but the policy itself can be set by either the SCAs or the Site Owners.
Creating a new Site Policy
Site policies are created by SCAs in the ‘Site Policies’ option. When this option is selected, a new page opens with three sections to complete:
- Name and description. As the policy only allows a site to be closed and deleted, the policy name should be something like ‘Site Closure and Deletion Policy’. The description should include a comment about why the site policy was created, for example ‘This is an inactive site, the entire site can be kept for 7 years’.
- Site closure and deletion. This part has three choice options (see below for more information):
- Do not close or delete site automatically (default)
- Delete sites automatically
- Close and delete sites automatically
- Site collection closure. This is a single check box with the words ‘The site collection will be read only when it is closed’.
More than one site policy may be created although in practice this is probably not necessary given the limited outcomes.
Site closure and deletion options
The ‘Site Closure and Deletion’ section of the site policy has three choices, described below.
Do not close or delete site automatically
The first, default, option is only likely to be used if there is a requirement to ensure the site is never closed or deleted (e.g., by an owner).
Delete sites automatically
The option to ‘Delete sites automatically’ has several options as shown in the screenshot below.
The ‘Deletion Event’ choices are:
- Site created date. This choice will result in the deletion of the site without it being closed (which makes the site read only – see below). There is a risk that someone might continue to use the site if it is not closed.
- Site closed date. This choice requires a manual closure (see below) or it won’t do anything.
The rest of the options are self evident.
Close and delete sites automatically
As can be seen, this choice is very similar to the previous option but it includes a site closure option that is based (only) on the ‘Site created date’.
When a site is closed AND the check box is selected (to make the site read only when it is closed), the site is made read only and a notice appears across the top of the site: ‘This site is read only at the site collection administrator’s request’.
Check box – the site collection will be read only when closed
If this box is checked, the site collection will be read only when it is closed. The only reason NOT to check this box is if the site should remain active until it is deleted, which carries some risk as the site may continue to be used. It is preferable to close the site with the check box selected so the site becomes read only when it is closed.
Next step – enable Site Closure and Deletion
Once the site policy has been created, it must be enabled on the site. This is achieved in the ‘Site Closure and Deletion’ option under ‘Site Administration’, which has three sections as shown (before any site policy is selected).
The Site Closure and Deletion section is not active until a Site Policy is selected. The details displayed will change when a Site Policy is selected, as shown in the screenshot below.
The ‘Site Closure’ option shows either (a) ‘Close this site now’ if the date for closure has not been reached, or (b) the date on which the site was closed, with the option to (re) open the site.
The ‘Site Deletion’ option shows the date on which the site will be deleted, with the option to postpone deletion for the specified period.
The ‘Site Policy’ option shows the name of the Site Policy that was selected. As can be seen, only one site policy can be selected.
What should you do once a site policy has been enabled?
Before the site is closed and made read only, it may be useful to do the following:
- Removing anything on the home page that presents content from the site or is superfluous.
- Adding a note on the front page advising that the site will be deleted at a given date, with details of who to contact about this.
- Recording this deletion event in a log of sites to be deleted this way (and noting its deletion in that log after it is).
- Consider exporting the metadata of all site libraries that contain records to somewhere else, as this information is not otherwise kept.
As noted, when a site is closed and the check box selection makes the site read only, two notices appears across the top of the site advising (a) when the site will be deleted and (b) that the site is read only. No changes can be made to the site.
Site Owner notification and actions
Site Owners will receive an initial email notification on the date set in the policy, and then follow up email notifications.
Site Owners may postpone deletion for the period of time set in the policy.
If the Site Owner decides that the site is still required, the SharePoint Administrators or Site Collection Administrators can remove or modify the policy accordingly.
What happens when a site is deleted?
If the site policy deletion date is reached and the policy is not extended, the site and all its content is sent to the SharePoint Administration Recycle Bin. That is, it becomes visible in the ‘Deleted sites’ section of the SharePoint Admin portal where it will remain for 90 days. After that, it (and all its content) is permanently deleted.
When would you create and apply a site policy?
Site policies – as opposed to retention labels/policies applied to document libraries or lists – are useful to apply to entire inactive sites that contain content with the same retention requirement. For example:
- Project sites.
- Inactive sites that belonged to business units that ceased to exist.
- Communication sites used for short-term purposes.
A word of caution
It is important to remember that the entire site is deleted when a site policy is set.
If there is a requirement to keep a record of what was stored in the site, it may be useful to export a record of the site contents and the metadata of every library (and perhaps list) on the site.
As no record will be kept of the site in the SharePoint administration portal after it has been permanently deleted, it is recommended that SharePoint Admins keep a separate record (in a SharePoint list, for example), of all sites that have been deleted (and when).
Records about the world 
Hi,
The “Site Policies” does not get listed in any settings / menu’s even though I am the global admin. What could be wrong here?
Was to be get through. https://%5Btenant%5D.sharepoint.com/sites/contentTypeHub
– Click on Settings in the Top Right Hand Side >> Site Collection Administration >> Site collection features >> “Site Policies” = Activate
Yes, to get to the Site Policy option, click on the gear/cog icon on the top right, go to Site Information – Site Settings, then under the section ‘Site Collection Administration’ click on Site Collection Features. You should see ‘Site Policy’ as a feature to be enabled. You cannot get to the Site Settings if you are not a SharePoint Admin (role) or Site Collection Administrator.