Compliance and Retention Policies

Retention policies for Teams are configured in the Microsoft Purview compliance portal, not in the Teams admin center, and they target different underlying storage locations depending on content type: channel messages are captured in a hidden group mailbox associated with the Team, 1:1 and group chat messages are captured in each participant's own Exchange Online mailbox, and files shared anywhere in Teams are governed by the SharePoint or OneDrive retention settings applied to the site hosting them. This means a single retention policy scoped to 'Teams channel messages' will not automatically retain files posted in that same channel — file retention has to be configured separately against the associated SharePoint site, which is a common gap organizations miss during compliance audits.

When an organization anticipates litigation or a regulatory investigation, Purview eDiscovery (Standard or Premium) lets a compliance officer place a legal hold on specific custodians' Teams content, which suspends normal deletion — even if a user deletes a message or an admin's retention policy would otherwise purge it, the held copy is preserved in a hidden Substrate Preservation Hold Library invisible to end users. Because chat lives in individual mailboxes and channel messages live in the Team's group mailbox, an eDiscovery search scoped only to a custodian's personal mailbox can miss channel content unless the search also includes the Teams the custodian belongs to, which is why properly scoping an eDiscovery case (not just naming custodians) is critical to defensible collection.

Beyond retention and hold, Purview Communication Compliance lets organizations configure policies that scan Teams messages for specific risk categories — offensive language, sensitive data leakage, or regulatory phrases relevant to industries like financial services — and route flagged messages to a reviewer without the sender being notified, which is commonly required for regulated firms under rules like FINRA's supervision requirements. Information Barriers, a related but distinct feature, proactively prevents certain groups from communicating or collaborating at all, such as blocking an investment bank's research analysts from chatting with the trading desk, and is enforced at the point someone tries to add a person to a chat, Team, or channel, not just monitored after the fact.