Microsoft 365 retention policies explained

What a Microsoft 365 retention policy is

Retention in Microsoft 365 is part of Microsoft Purview Data Lifecycle Management. Microsoft describes two actions, retain content (prevent permanent deletion and keep it available for eDiscovery) and delete content (permanently delete it from your organisation), which combine into three outcomes:

• Retain-only: keep content forever or for a specified period
• Delete-only: permanently delete content after a specified period
• Retain and then delete: keep content for a specified period, then permanently delete it

Retention works with content in place. People carry on working with their mail and documents as normal; if they edit or delete something covered by a retention setting, Microsoft 365 keeps a copy in a secure location that most users cannot see:

Microsoft points out that the Preservation Hold library counts towards the site's storage quota, so retention settings on SharePoint, OneDrive and Microsoft 365 groups can increase the storage you use.

Where retention policies apply

Retention policies can be applied to these locations, according to Microsoft Purview's documentation:

• Exchange mailboxes and Exchange public folders
• SharePoint classic and communication sites
• OneDrive accounts
• Microsoft 365 group mailboxes and sites
• Teams channel messages, Teams chats and Teams call logs
• Viva Engage community and user messages
• Microsoft Copilot experiences and other AI apps
• Skype for Business

Each policy has a scope. A static scope applies to all instances of a location (often called an org-wide policy) or to listed inclusions and exclusions. An adaptive scope uses a query against attributes such as a user's department or job title, so membership updates automatically as people join, move and leave. Microsoft notes that OneDrive URLs are hard to specify reliably in static scopes because they change when a user's sign-in name changes, which is one reason adaptive scopes are often easier to maintain.

Retention policies vs retention labels

Purview gives you two ways to apply retention settings, and you can combine them:

Microsoft's example is simple: if every document in a site should be kept for five years, a policy is the efficient choice; if some must be kept for five years and others for ten, you need labels.

Is there a default retention policy in Microsoft 365?

There is no Purview retention policy that Microsoft switches on for you to keep everything. Purview retention policies and labels exist only once someone in your organisation creates them.

The closest thing to a default is in Exchange Online. Exchange creates a messaging records management policy called the Default MRM Policy and applies it automatically to new users. Its main tags move mail rather than delete it:

Microsoft says the Default MRM Policy has no default policy tag that deletes items, and no tag that empties the Deleted Items folder automatically. Microsoft now recommends Purview retention policies and labels for retaining and deleting mailbox content, and messaging records management only for moving mail to archive mailboxes. If you need to understand archive mailboxes, our Email Archiving site covers Exchange Online Archiving.

When policies conflict: the principles of retention

Content is often covered by more than one retention setting, and Microsoft applies a fixed order to decide the outcome:

1. Retention wins over deletion. Content is not permanently deleted while any setting says to retain it, even if a user deletes it from view.
2. The longest retention period wins. If settings retain the same item for different periods, it is kept until the end of the longest one.
3. Explicit wins over implicit for deletions. A retention label's delete action takes precedence over a policy's, and a policy aimed at specific users or sites takes precedence over an org-wide one.
4. The shortest deletion period wins when the earlier principles have not settled it.

eDiscovery holds sit above all of this: content on hold cannot be permanently deleted by any retention setting until the hold is released. Microsoft also applies a 30-day grace period when a retention policy for SharePoint or OneDrive is removed, so content is not lost the moment a policy is switched off.

Why a retention policy is not a restore tool

Retention policies are designed for compliance: keeping what you must and disposing of what you should not keep. They were not designed to put data back the way it was. In practice:

• Retained copies are hidden. Getting content back from the Preservation Hold library or Recoverable Items usually means a search or eDiscovery export, item by item, rather than a restore of a whole site or mailbox to a point in time.
• They share the tenant's fate. Policies are managed by the same admin roles as everything else; an attacker or a mistake that changes them changes your protection.
• Deletion is a feature. A delete-only or retain-then-delete policy permanently removes data at the end of its period, by design.
• Not every workload or setting is covered. Policies keep content; they do not keep site structure and permissions or Entra ID settings in a restorable form.

Microsoft makes the same point about legal holds in its Microsoft 365 Backup FAQ: they retain data but are optimised for export, not mass restore. Our Microsoft 365 backup vs retention guide compares the two in detail, and Microsoft 365 backup solutions shows the backup options.

Setting up retention, and how we help

Retention policies and labels are created in the Microsoft Purview portal, under Data Lifecycle Management for most policies and Records management for records and advanced labelling. The Policy lookup feature shows which policies apply to a given user, site or group. Which Purview features you can use depends on your Microsoft 365 plan; Forever Group's Microsoft licensing team can check what your licences include.

How long to keep particular records, especially email, is a legal and regulatory question rather than a technical one. Our Email Archiving site covers email retention policy periods for UK organisations. What we help with is the recovery side: making sure a backup covers every workload your retention policies do, with its own retention set to match, so a deleted or damaged item can be restored rather than only found.

Contact us to check your retention settings against your backup.