Microsoft 365 will keep or delete content automatically based on retention rules configured by administrators. Retention policies and labels turn legal, regulatory, and business requirements into settings that run quietly in the background. Getting them right means understanding how the rules interact, when deletion is appropriate, and why retention is a different thing from backup.
What retention rules actually do
Microsoft Purview provides the tools administrators use to control how long Microsoft 365 content is kept and when it should be deleted. It offers two basic retention actions: retain content so it cannot be permanently deleted, and delete it permanently. Combined, these produce three possible outcomes: retain only, delete only, or retain for a set period and then delete.
Content stays where it already lives, so people can continue working normally. If someone edits or deletes an item subject to retention, Microsoft quietly preserves a copy in a protected location, such as the Preservation Hold library for SharePoint and OneDrive or the Recoverable Items folder for Exchange mailboxes. Note that the Preservation Hold library counts toward a site’s storage quota, so retention can increase storage requirements.
Retention policies vs. retention labels
Administrators use two main tools to put retention requirements into practice: retention policies and retention labels. The difference is largely a matter of scope.
A retention policy applies the same set of rules to a broader location, such as a SharePoint site, Exchange mailbox, or Teams location. A retention label, by contrast, applies rules to an individual item, such as a document, folder, or email. This is useful when different records within the same location need different retention periods or treatment.
Labels also offer more flexibility in how retention periods are triggered. The clock can start when a label is applied or when a specific event occurs, such as an employee leaving or a contract expiring. They can also require a disposition review before content is permanently deleted.
The two tools often work together: policies establish the default retention rules for a location, while labels provide more specific instructions for individual records that need different treatment.
Setting retention periods based on requirements
Once retention policies and labels are in place, the next step is deciding how long content should be kept. Those periods should reflect legal, regulatory, and contractual obligations, not administrative convenience. For example, certain records may need to be retained for seven years under requirements such as the Sarbanes-Oxley Act. Tax, employment, healthcare, and client agreements may impose different timelines, so legal or compliance advisors should help determine the appropriate periods before retention settings are applied.
Beyond those requirements, avoid keeping content indefinitely without a clear business reason. Unnecessary records increase storage and e-discovery costs, expand the amount of data exposed in a breach, and make it harder to find relevant information.
How Purview resolves conflicting rules
A document or email may be covered by several retention policies and labels at the same time. When their instructions differ, Microsoft Purview uses four principles to determine what happens: retention takes precedence over deletion, the longest retention period wins, an explicit deletion instruction from a label takes precedence over an implicit deletion instruction from a policy, and the shortest deletion period applies among the remaining eligible rules.
For example, if an email is subject to a policy that deletes content after three years and a label that retains it for five years, Purview keeps it for five years before deletion. An eDiscovery hold takes precedence over these retention settings, although Microsoft advises against using holds for long-term life cycle management.
New retention settings can take up to seven days to take effect, so test them on a small group of sites or mailboxes before applying them across the organization.
Retention is not a backup
Retention policies and labels help organizations control how long Microsoft 365 content is kept for governance and compliance, but they are not designed for full data recovery. They do not create independent backup copies or point-in-time restore options. Recovering a lost folder may require searching protected locations or running an eDiscovery search rather than simply clicking Restore. More importantly, retention preserves content as users change or delete it; it does not provide a clean copy from before an incident such as ransomware or a mass deletion by a compromised account.
Recycle bins offer some short-term recovery, but their protection is limited. Deleted SharePoint and OneDrive items remain recoverable for about 93 days across both stages, while Exchange retains deleted items for 14 days by default, extendable to 30. Confirm these settings in your own tenant, as defaults may change. For more reliable recovery, organizations need an independent backup of their Microsoft 365 data, whether through Microsoft’s own backup service or a third-party solution.
A practical starting point
Start by identifying the main content types, mapping each to its legal, regulatory, or business requirements, and creating a small set of retention policies before introducing labels for more specific needs. Test the settings on one site or mailbox group, review the results with legal or compliance advisors, and expand gradually.
Take particular care with Preservation Lock: once enabled, it prevents anyone, including administrators, from modifying or removing the protected policy. Document the reasoning behind each decision and review the plan annually to keep pace with changing regulations and business needs.
Not sure how long your business should keep its Microsoft 365 documents, or whether your data is truly recoverable? Our team can review your retention settings, align them with your compliance needs, and set up backup that fills the gaps. Reach out to get started.