Apply retention policies to Exchange, SharePoint, OneDrive, Teams and Copilot

Description

Microsoft Purview retention policies retain content for at least {{ retention_years }} years (or the durations set by the organization's records schedule) on these locations, for all users and sites:

• Exchange mailboxes;
• SharePoint classic and communication sites;
• OneDrive accounts;
• Teams channel messages and Teams chats;
• Microsoft Copilot experiences (Copilot interactions).

The durations come from the legal and regulatory retention schedule approved by the legal team and the data protection officer; the retention action is Retain items or Retain and then delete according to that schedule.

{{ retention_years }} years is a default inspired by public sector practice; set the value from your legal obligations (for example accounting records, labour law, sector rules).

Rationale

Retention protects against deletion by mistake, by a malicious insider, or by an attacker who wipes mailboxes and sites after exfiltration or during ransomware. It also keeps the records needed for investigations, litigation and regulatory requests, including Copilot prompts and responses which are business records like any other communication.

Impact

Retained content consumes storage (Recoverable Items and Preservation Hold Library) and cannot be deleted before the end of the period, including on request under GDPR unless an exception process exists. Durations that are too long conflict with data minimization: align them with the records schedule rather than keeping everything.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global Reader.
2. Browse to Solutions > Data Lifecycle Management > Policies > Retention policies.
3. Check that enabled policies cover, for all users or sites, Exchange mailboxes, SharePoint classic and communication sites, OneDrive accounts, Teams channel messages, Teams chats and Microsoft Copilot experiences, with a retention period of at least {{ retention_years }} years or the duration of the approved schedule.
4. Alternative in Security & Compliance PowerShell: Get-RetentionCompliancePolicy -DistributionDetail | Format-List Name,Enabled,Mode,DistributionStatus,ExchangeLocation,SharePointLocation,OneDriveLocation,TeamsChannelLocation,TeamsChatLocation and Get-RetentionComplianceRule | Format-List Policy,RetentionDuration,RetentionComplianceAction.
5. Fail if a location is not covered, a policy is disabled or in error, or the retention period is shorter than required.

Remediation

1. Get the retention schedule approved by the legal team and the data protection officer.
2. Sign in to the Microsoft Purview portal as at least a Compliance Administrator (or Retention Management role).
3. Browse to Solutions > Data Lifecycle Management > Policies > Retention policies > New retention policy.
4. Select Static scope, then the locations listed in the description, all users or sites.
5. Set Retain items for a specific period to the required duration, and the action at the end of the period according to the schedule.
6. Create separate policies where durations differ (for example Teams chats shorter than mailboxes).
7. PowerShell alternative: New-RetentionCompliancePolicy with the locations, then New-RetentionComplianceRule -RetentionDuration <days> -RetentionComplianceAction Keep.

Rollback

Disable or delete the retention policy. Content is then subject to normal deletion; a policy with Preservation Lock cannot be turned off.

References

• Learn about retention policies and retention labels Microsoft, vendor-doc, accessed 2026-10-24
• Create and configure retention policies Microsoft, vendor-doc, accessed 2026-10-24
• Learn about retention for Copilot and AI apps Microsoft, vendor-doc, accessed 2026-10-24
• ASD Blueprint for Secure Cloud Australian Signals Directorate, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle