Topic 4 of 6
Data lifecycle and records
Keep what must be kept and delete what's left over. The exam asks when to use a retention policy or label, what wins when they conflict, and what sets a record apart from a regulatory record.
Contents
Data Lifecycle Management
Microsoft Purview tools to retain the content you need and delete what you don't. Deleting content with no business value also reduces the attack surface.
- Meet regulations that require keeping content for a minimum time
- Reduce risk in litigation or breaches by deleting old content
- Make sure users work only with current, relevant content
It works with SharePoint, OneDrive, Microsoft Teams, Viva Engage, and Exchange.
Retain and delete
Retain only
Forever or for a set period.
Delete only
Permanently delete after a period.
Retain then delete
Keep for a period and then delete.
Retained content stays in its original location and users work normally. If they edit or delete it, a copy is automatically kept in a secure location most people can't see. Retaining also keeps it available for eDiscovery.
How retention works under the hood
Users don't notice anything: they keep editing and deleting. What changes is that the system keeps a protected copy when needed.
SharePoint and OneDrive
If a retained item is edited or deleted, a copy is kept in the site's Preservation Hold library.
Exchange and Teams
Deleted or modified messages are kept in the mailbox's Recoverable Items folder, which the user doesn't see.
Example of a "retain for 5 years, then delete" setting:
During the period: The user works normally. If they delete the document, it disappears from their view but the copy is kept.
At the end of the period: If the item is still in its original location, it's deleted. If a preserved copy existed, it's permanently deleted.
With disposition review: Instead of deleting automatically, a reviewer decides first (labels only).
The period can count from when the item was created, when it was last modified, when it was labeled, or from an event.
Retention policies vs. retention labels
| Retention policy | Retention label | |
|---|---|---|
| Level | Site or mailbox (container) | Item: folder, document, or email |
| If the item moves | Settings don't travel with it | Travels within the Microsoft 365 tenant, not outside |
| How many per item | Several can apply | Only one at a time |
| How applied | Automatically by location | Manually, automatically by conditions, or by default in SharePoint |
| Disposition review | No | Yes |
| Declare as a record | No | Yes |
Labels are published with a retention label policy, which defines the locations and users they're available to.
Static scope
The policy applies to locations picked by hand: all mailboxes, or a specific list of sites.
Adaptive scope
The policy applies based on attributes (for example, department = Finance) and updates itself when someone joins or leaves the group.
Microsoft's example
All documents in a site are kept for 5 years: use a policy. Some must be kept for 10: add a 10-year label to those items.
Principles of retention
When several settings apply to the same item, they're resolved in this order:
Retention wins over deletion
If one setting says retain and another says delete, the item is retained.
The longest retention period wins
If one says 5 years and another 7, it's retained for 7.
Explicit inclusion wins over implicit
For deletion: a label beats a policy, and a policy scoped to specific locations beats an org-wide one.
The shortest deletion period wins
If only deletion policies remain, the shortest one deletes the item.
Archiving, inactive mailboxes, and AI
Mailbox archiving
Extra space, with auto-expanding archiving for mailboxes that exceed the limit.
Inactive mailboxes
If the mailbox is placed on hold before the employee's account is deleted, it's retained indefinitely.
Adaptive protection
Integration with Insider Risk Management: applies retention labels based on risk to prevent malicious deletion.
AI interactions
Microsoft 365 Copilot prompts and responses are stored in the Exchange mailbox and governed by retention policies.
Records Management
It builds on Data Lifecycle Management and adds control for items of high legal, regulatory, or business value. When content is marked as a record with a retention label: certain activities are blocked, actions are logged, and proof of disposition is kept at the end of the period.
Record
Restricts actions on the item and tracks it throughout its lifecycle.
Regulatory record
Nobody, not even a Global Administrator, can remove the label, and the period can't be shortened. It isn't available by default: it's enabled with PowerShell.
| Standard label | Record | Regulatory record | |
|---|---|---|---|
| Delete the item | Yes (a copy is kept) | No | No |
| Edit the content | Yes | No, unless unlocked (record versioning) | No |
| Remove the label | Yes | Only the container admin (locked record) | Nobody |
| Available | By default | By default | Must be enabled with PowerShell |
Event-based retention
The period starts when an event occurs, not from creation or modification. Example: keeping employee records for 7 years after the employee leaves.
- End of employment
- Product discontinued
- Contract expired
Disposition review and file plan
Disposition review
Before deletion, designated reviewers approve it or extend retention. Proof of disposition is kept for auditors.
File plan
Imports an existing retention schedule, shows all labels in one place, and adds details like regulatory authority or business function.
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| Keep all of the organization's email for 7 years | Retention policy | It applies to the whole location. |
| Keep only a site's contracts for 10 years | Retention label | It applies to specific items. |
| Automatically delete Teams chats older than 2 years | Delete-only retention policy | It reduces risk and volume. |
| Keep the mailbox of an employee who leaves the company | Inactive mailbox | Retention applied before deleting the account. |
| Make sure nobody can modify or delete a document during the period | Label that declares a regulatory record | Not even a Global Administrator. |
| Start the period when a contract ends | Event-based retention | The event starts the period. |
| Have a manager approve deletion at the end of the period | Disposition review | It leaves proof of disposition. |
| Import the retention schedule the company already uses | File plan | It manages all labels in one place. |
Common exam traps
❓ A policy deletes after 3 years and a label retains the same document for 7 years. What happens?
It's retained for 7 years. Retention wins over deletion and the longest period wins.
❓ A document with a retention label moves to another site in the same tenant. Does it keep its retention?
Yes. Labels travel with content within the tenant. A policy's settings don't travel.
❓ Can a Global Administrator remove the label from a regulatory record?
No. Nobody can remove it or shorten its period. That's why it has to be explicitly enabled with PowerShell.
❓ Contracts must be kept 5 years from expiration, not from creation. What should you use?
Event-based retention, with the contract expiration as the triggering event.
❓ Can an item have several retention labels?
No. Only one at a time. Several retention policies can apply to it, though.
❓ Does the retention label go with the document if it's sent outside the organization?
No. It travels within the Microsoft 365 tenant, not outside it.
❓ If a user deletes a retained document, is it lost?
No. It disappears from their view, but a copy is kept (Preservation Hold library or Recoverable Items) until the end of the period.
Did you get this topic?
Test what you just learned
Before some financial records are permanently deleted at the end of their retention, the legal team wants to review and decide. Which feature allows this?
Ready to test "Data lifecycle and records"?
Original questions, each with a full explanation.
Start a mock exam