🔐 Purview Course · Module 5 of 6
Retention Policies & Records Management
SC-400 Exam Alignment
SC-400
Skill: Implement data lifecycle management — Configure retention policies and retention labels for all Microsoft 365 workloads, use adaptive scopes for dynamic policy targeting, implement records management with file plans and record labels, configure event-based retention, and manage disposition review.
- Know the retention conflict resolution rule: retention always wins over deletion; if conflicting retention periods apply, the longest wins; the most specific policy wins (label over policy)
- Understand that retention policies apply automatically to ALL content in a location; retention labels apply to individual items (manually or auto-applied)
- Know that declaring content as a record prevents users from editing or deleting it; a regulatory record cannot even be removed by an administrator without explicit permission
- Event-based retention doesn’t start counting until a specific event occurs — not from when the label was applied
Exam Tip: The most-tested scenario is conflicting retention settings. If a user tries to delete an email that has both a 1-year retention policy AND a 7-year retention label, the 7-year label wins (most specific AND longest). The email is retained for 7 years even if the user “deletes” it — the delete action creates a “soft delete” in the Recoverable Items folder.
Retention policies and retention labels are the mechanism that ensures your organisation keeps what it must keep and deletes what it must delete — in compliance with legal, regulatory, and operational requirements. Unlike backup systems that preserve data for disaster recovery, retention in Microsoft Purview preserves content for compliance, even if a user deletes it, while also permanently deleting content when its retention period expires.
📅 Retention Policies vs Retention Labels
These are the two complementary tools for managing data lifecycle. Understanding which to use for each scenario is critical for SC-400.
| Feature | Retention Policy | Retention Label |
|---|---|---|
| How it applies | Automatically to ALL content in specified locations — no user action needed | Applied per-item — manually by user, or automatically via auto-apply label policies |
| Granularity | Location-level (all of Exchange, specific SharePoint sites, all OneDrive) | Individual item level (specific file, email, or list item) |
| Precedence in conflicts | Lower priority — label wins if both apply to the same item | Higher priority — overrides any conflicting retention policy on the same item |
| Records declaration | Cannot declare items as records | Can mark items as records (immutable) or regulatory records (permanently immutable) |
| Disposition review | Content is auto-disposed at expiry — no manual review possible | Can require a human disposition reviewer before content is deleted |
| Event-based retention | Not supported | Supported — retention period starts when a specified event occurs |
| File plan integration | Not part of file plan | Managed in the file plan — can be given a file plan descriptor for regulatory reference |
⚖️ Retention Conflict Resolution
When multiple retention settings apply to the same item, Purview uses the following priority rules:
🔢 The Four Rules of Retention Conflict Resolution
- Rule 1 — Retention wins over deletion: If any retention policy says “keep for X years,” the content is kept even if the user deletes it
- Rule 2 — Longest retention period wins: If a 3-year and a 7-year retention policy both apply, the 7-year period wins
- Rule 3 — Explicit deletion overrides implicit: A policy that says “delete after 3 years” overrides a policy that says “keep indefinitely” if the item’s retention period has passed
- Rule 4 — Retention labels win over policies: A retention label on an individual item overrides any conflicting retention policy for that item — labels are more specific
🗺️ Retention Policy Locations
| Location | What It Covers | Notes |
|---|---|---|
| Exchange mailboxes | Email messages, calendar items, contacts, and tasks in user mailboxes (including inactive mailboxes) | Deleted items go to Recoverable Items; after retention period they are purged by the compliance engine |
| SharePoint sites | All files in document libraries and lists in specified SharePoint sites or all sites | Retained content is held in the Preservation Hold library — a hidden library in each SharePoint site |
| OneDrive accounts | Files in specified users’ OneDrive or all users | Same Preservation Hold library mechanism as SharePoint |
| Microsoft 365 Groups | Group mailbox (Exchange) AND the group’s SharePoint site — both covered by one policy entry | When you scope a retention policy to Groups, it covers both the mailbox and SharePoint connected to that group |
| Teams channel messages | All channel messages including replies — in all Teams or specific Teams | Separate from Exchange. Teams messages are stored in a hidden per-user mailbox, not Exchange Online |
| Teams chats | One-to-one and group chats — separate from channel messages | Stored in user mailboxes in a hidden folder. Must be configured as a separate location from Teams channel messages. |
| Viva Engage | Yammer community and private messages | Stored in the organisation’s Azure Blob storage — not Exchange or SharePoint |
🎯 Adaptive Policy Scopes
Instead of manually specifying users or sites in a policy, adaptive scopes use queries to dynamically include the right content locations. This is especially useful for large or changing organisations.
| Scope Type | Query Basis | Example |
|---|---|---|
| Users (Exchange/OneDrive) | Entra ID user attributes: department, country, job title | Scope = all users where Department = “Finance” — automatically includes/excludes users as HR updates the attribute |
| Sites (SharePoint) | SharePoint site properties or sensitivity labels on sites | Scope = all SharePoint sites with sensitivity label “Confidential” — new labelled sites automatically included |
| Microsoft 365 Groups | M365 Group attributes | Scope = all groups where sensitivity label = “Confidential” — relevant for Teams and Group-based retention |
🗄️ Records Management
Records management is a more advanced data lifecycle capability that provides legally defensible immutability and a formal review process before disposal.
Record Types
| Record Type | Who Can Edit | Who Can Delete | Use Case |
|---|---|---|---|
| Retention label (non-record) | Anyone with edit access | Anyone — content is retained in Preservation Hold even after user deletion | Standard retention for compliance |
| Record | No one — content is locked (read-only) | No one until retention period expires; then goes to disposition review | Regulatory compliance, legal hold |
| Regulatory record | No one | No one — even global admins cannot remove the record status without Microsoft support intervention | Strictest regulation: SEC 17a-4, FINRA, CFTC |
File Plan
The file plan (Records management → File plan) is a central catalogue of all retention labels with additional metadata: business function, department, category, authority type (regulation name), and provision/citation (specific regulation article). This maps each label to the regulation that requires it, providing an auditable rationale for every retention period.
Event-Based Retention
For some content, the retention period should start from a business event rather than from creation or modification. Event-based retention solves this.
| Scenario | Event Trigger | Retention Start |
|---|---|---|
| Employee contracts | Employee leaves organisation | 7 years from employee departure date |
| Product documentation | Product is discontinued | 10 years from product discontinuation date |
| Customer contracts | Contract expires | 5 years from contract expiry date |
PowerShell — Retention Policies & Labels
# List all retention policies and their settings Get-RetentionCompliancePolicy | Select-Object Name,RetentionDuration,RetentionAction,Enabled # List all retention labels — including which are record/regulatory Get-ComplianceTag | Select-Object Name,RetentionDuration,RetentionAction,IsRecordLabel,IsRegulatoryLabel # Create a 7-year Exchange retention policy (2555 days) New-RetentionCompliancePolicy -Name 'Finance Email 7yr' ` -ExchangeLocation All New-RetentionComplianceRule -Name 'Retain 7 years' ` -Policy 'Finance Email 7yr' ` -RetentionDuration 2555 ` -RetentionComplianceAction Keep # Create a record label (declares items as records when applied) New-ComplianceTag -Name 'Contract Record' ` -RetentionDuration 1825 ` -RetentionAction Delete ` -IsRecordLabel $true
💡 Best Practices
- Use retention policies for broad baseline retention across all content in a location, and retention labels for exceptions that need different periods
- Configure adaptive scopes rather than static user/site lists for large deployments — adaptive scopes automatically update as users change departments or sites gain new labels
- Always test record labels with standard records first before deploying regulatory records — regulatory records cannot be removed without Microsoft support intervention
- Enable disposition review for record labels — before content is automatically deleted after its retention period, a named reviewer confirms the deletion is appropriate
🎓 Interview Q&A
Q: An employee in the Finance team manually deletes an email that has a “Finance Contract” retention label with a 7-year retention period. What actually happens to the email, and can the user retrieve it?
What happens: When the user deletes the email, Exchange Online moves it to the Deleted Items folder as normal. If the user empties Deleted Items, the email moves to the Recoverable Items folder (hidden from the user). Here, the Purview compliance engine detects the retention label and prevents the email from being permanently purged — it remains in Recoverable Items for the full 7-year retention period, even if that item was “deleted” on day one.
Can the user retrieve it? Yes — from the Recoverable Items folder in Outlook using the “Recover Deleted Items” option, within the standard 14-day (or up to 30-day) soft-delete recovery window. After that window, the item is in the compliance-hold sublayer of Recoverable Items (only visible to admins via eDiscovery or compliance tools) — the user cannot retrieve it but the compliance team can access it for legal hold or eDiscovery purposes.
🎯 SC-400 Mock Test
Module 5 — Retention Policies & Records Management
5 questions · Scenario-based · Pass mark: 70%
Q1 of 5
A SharePoint site has a retention policy applying a 1-year retention period. A document in that site has a retention label applied with a 5-year retention period. The document is 2 years old and a user deletes it. What is the outcome?
AThe document is deleted — the user’s action overrides both the policy and the label
BThe document is retained for 1 year (retention policy wins as it’s the shorter period)
CThe document is retained in the Preservation Hold library for a further 3 years (5 years total from creation) — the label wins over the policy and the longest period applies
DThe document is retained for 1 year more (total of 3 years from creation)
✅ C. Applying both conflict resolution rules: (1) the label wins over the policy (labels are more specific), so the 5-year retention applies. (2) The document is 2 years old, so it must be retained for another 3 years. When the user deletes it, SharePoint moves a copy to the Preservation Hold library for the remainder of the retention period.
Q2 of 5
Which retention feature should be used to ensure that employee contract documents are retained for exactly 7 years from the date the employee leaves the organisation — not from when the contract was signed?
ARetention policy with a 7-year duration applied to the SharePoint HR library
BEvent-based retention with a retention label that starts the 7-year period when an “Employee departure” event type is triggered for that employee
CAdaptive scope retention policy that automatically adjusts the retention period based on the employee’s departure attribute in Entra ID
DRecord label — records are retained indefinitely until manually reviewed and deleted
✅ B. Event-based retention is designed exactly for this scenario: the retention period doesn’t start until a specific business event occurs. You create an event type (“Employee Departure”), apply the retention label to employee contract documents, and configure the event type to link to an employee ID. When HR triggers the “Employee Departure” event for a specific employee ID, the 7-year retention period begins for all documents tagged with that employee’s ID.
Q3 of 5
A compliance administrator applies a “Regulatory Record” label to a document in SharePoint. The next day, the Global Administrator tries to remove the regulatory record label from the document. What happens?
AThe Global Administrator can remove the regulatory record status using PowerShell with the Remove-ComplianceTag cmdlet
BThe Global Administrator can remove it from the compliance portal using the Records Management dashboard
CThe status can be removed by a Records Manager role — the Global Admin doesn’t have this specific permission
DThe regulatory record label cannot be removed by anyone — not even a Global Administrator. Removing it requires contacting Microsoft Support to unlock the item.
✅ D. This is the defining characteristic of regulatory records. Unlike standard records, regulatory records are permanently locked — no one within the organisation, including Global Administrators, can remove the regulatory record status once applied. Only Microsoft Support intervention can unlock a regulatory record. This meets the requirements of strict financial regulations (SEC 17a-4, FINRA).
Q4 of 5
A retention policy is configured for Microsoft Teams channel messages with a 3-year retention period. Where is the retained Teams message content stored after a user deletes a channel message?
AIn a hidden SubstrateHolds folder within the user’s Exchange Online mailbox — retained there until the retention period expires
BIn the SharePoint Preservation Hold library connected to the Team’s site
CIn the organisation’s Azure Blob storage as a compliance backup
DIn the Recoverable Items folder in Exchange Online — same as email retention
✅ A. Teams messages are stored in Exchange Online in a hidden mailbox area per user, not in SharePoint. When a Teams message is deleted and a retention policy applies, the retained copy is stored in a hidden SubstrateHolds folder within the Exchange Online mailbox infrastructure — separate from the user’s visible mailbox. This is different from email (Recoverable Items) and SharePoint (Preservation Hold library).
Q5 of 5
Which feature allows a compliance team to require human approval before content is permanently deleted after a retention label’s retention period expires?
AAdaptive scope review — the adaptive scope queries whether items are still needed before deleting
BDLP policy review — a DLP rule can hold deletion until a compliance officer approves
CDisposition review — configured on the retention label’s end-of-period settings; named reviewers must approve or reject each item before deletion
DRecord lock — records cannot be deleted automatically; an administrator must manually unlock them first
✅ C. Disposition review is the feature that requires human approval before content is permanently deleted. When a retention label’s period expires and disposition review is enabled, the items appear in the Records Management → Disposition review queue. Named reviewers receive email notifications and must either approve deletion, relabel the item, or extend the retention period.
🔒
Locked — Pass Module 4 quiz to unlock this module.