{
  "id": "CB-M365-DATA-007",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-007",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-007.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-007.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DATA-007",
    "title": "Apply retention policies to Exchange, SharePoint, OneDrive, Teams and Copilot",
    "finding": {
      "title": "Microsoft 365 content can be deleted permanently with no retention policy",
      "description": "A user, an insider or an attacker who deletes mail, files or chats removes them for good once the recycle bins are emptied, which destroys evidence and business records."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "retention",
      "purview",
      "data-lifecycle",
      "records",
      "copilot",
      "ransomware"
    ],
    "description": "Microsoft Purview retention policies retain content for at least **{{ retention_years }}** years\n(or the durations set by the organization's records schedule) on these locations, for all\nusers and sites:\n\n- Exchange mailboxes;\n- SharePoint classic and communication sites;\n- OneDrive accounts;\n- Teams channel messages and Teams chats;\n- Microsoft Copilot experiences (Copilot interactions).\n\nThe durations come from the legal and regulatory retention schedule approved by the legal team\nand the data protection officer; the retention action is **Retain items** or **Retain and then\ndelete** according to that schedule.\n",
    "rationale": "Retention protects against deletion by mistake, by a malicious insider, or by an attacker who\nwipes mailboxes and sites after exfiltration or during ransomware. It also keeps the records\nneeded for investigations, litigation and regulatory requests, including Copilot prompts and\nresponses which are business records like any other communication.\n",
    "impact": "Retained content consumes storage (Recoverable Items and Preservation Hold Library) and cannot be\ndeleted before the end of the period, including on request under GDPR unless an exception\nprocess exists. Durations that are too long conflict with data minimization: align them with the\nrecords schedule rather than keeping everything.\n",
    "notes": "{{ retention_years }} years is a default inspired by public sector practice; set the value from\nyour legal obligations (for example accounting records, labour law, sector rules).\n",
    "parameters": [
      {
        "name": "retention_years",
        "type": "integer",
        "description": "Minimum retention period for Microsoft 365 content when no more specific records schedule applies.",
        "unit": "years",
        "default": 7,
        "minimum": 1
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global\n   Reader.\n2. Browse to **Solutions** > **Data Lifecycle Management** > **Policies** > **Retention\n   policies**.\n3. Check that enabled policies cover, for all users or sites, **Exchange mailboxes**,\n   **SharePoint classic and communication sites**, **OneDrive accounts**, **Teams channel\n   messages**, **Teams chats** and **Microsoft Copilot experiences**, with a retention period of\n   at least {{ retention_years }} years or the duration of the approved schedule.\n4. Alternative in Security & Compliance PowerShell: `Get-RetentionCompliancePolicy\n   -DistributionDetail | Format-List Name,Enabled,Mode,DistributionStatus,ExchangeLocation,SharePointLocation,OneDriveLocation,TeamsChannelLocation,TeamsChatLocation`\n   and `Get-RetentionComplianceRule | Format-List Policy,RetentionDuration,RetentionComplianceAction`.\n5. Fail if a location is not covered, a policy is disabled or in error, or the retention period\n   is shorter than required.\n"
    },
    "remediation": {
      "manual": "1. Get the retention schedule approved by the legal team and the data protection officer.\n2. Sign in to the Microsoft Purview portal as at least a Compliance Administrator (or Retention\n   Management role).\n3. Browse to **Solutions** > **Data Lifecycle Management** > **Policies** > **Retention\n   policies** > **New retention policy**.\n4. Select **Static** scope, then the locations listed in the description, all users or sites.\n5. Set **Retain items for a specific period** to the required duration, and the action at the\n   end of the period according to the schedule.\n6. Create separate policies where durations differ (for example Teams chats shorter than\n   mailboxes).\n7. PowerShell alternative: `New-RetentionCompliancePolicy` with the locations, then\n   `New-RetentionComplianceRule -RetentionDuration <days> -RetentionComplianceAction Keep`.\n",
      "rollback": "Disable or delete the retention policy. Content is then subject to normal deletion; a policy\nwith Preservation Lock cannot be turned off.\n"
    },
    "references": [
      {
        "title": "Learn about retention policies and retention labels",
        "url": "https://learn.microsoft.com/purview/retention",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Create and configure retention policies",
        "url": "https://learn.microsoft.com/purview/create-retention-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Learn about retention for Copilot and AI apps",
        "url": "https://learn.microsoft.com/purview/retention-policies-copilot",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ASD Blueprint for Secure Cloud",
        "url": "https://blueprint.asd.gov.au/",
        "publisher": "Australian Signals Directorate",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-12",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-11",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1485"
      },
      {
        "framework": "mitre-attack",
        "id": "T1070.008"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}