Retention and Compliance

Analogy categoryAnalogies

Understanding Retention and Compliance

Retention and compliance in SharePoint answer two related but distinct questions: how long must this content be kept (retention), and can it be found and produced if legally required (eDiscovery and compliance). Retention is enforced through retention labels applied to individual items or retention policies applied broadly across sites and locations, both configured in the Microsoft Purview compliance portal. A retention rule can require content to be kept for a fixed period, deleted after a period, or both retained-then-deleted, and it can be triggered from the date of creation, last modification, or a custom event like contract expiration. Crucially, retention settings can override a user's own delete action: if a document is under an active retention hold, deleting it from the library only removes the visible copy—a preserved version remains recoverable for the duration of the hold.

🏏

Cricket analogy: It's like the ICC's mandatory retention of match footage and official scorecards for a set number of years regardless of whether a broadcaster wants to archive it, and even if a team tries to have unflattering footage taken down, an official preserved copy remains recoverable under the retention rule.

Retention Labels vs. Retention Policies

A retention policy applies broadly and automatically to an entire location—every item in a SharePoint site or OneDrive account, for example—based on a single rule with no per-item nuance. A retention label, by contrast, is more granular: it's applied to individual items (manually by a user, automatically by a trained classifier or sensitive-information-type match, or as a default label on a library or folder) and can carry item-specific behavior, such as starting the retention clock from a custom event date rather than creation date. Labels can also be marked as 'Record' or 'Regulatory Record,' which locks the item against edits and, for regulatory records, even blocks deletion by anyone including administrators until the retention period expires—the strongest compliance guarantee SharePoint offers.

🏏

Cricket analogy: A retention policy is like a blanket broadcast-archiving rule applied to every match in a season uniformly, while a retention label is like flagging one specific match—say, a World Cup final—as a permanently protected historical record that can never be deleted, even by the broadcaster's own admins.

Legal Hold, eDiscovery, and Litigation

When litigation or a regulatory investigation is reasonably anticipated, organizations use eDiscovery cases (Standard or Premium, in Microsoft Purview) to place a legal hold on relevant content across SharePoint, OneDrive, Exchange, and Teams. A legal hold suspends normal retention and deletion rules for the affected content, preserving every version until the hold is explicitly released, even if a separate retention policy would have otherwise deleted it sooner. Within an eDiscovery case, legal and compliance teams can search across custodians and locations using keyword and conditional queries, review results in a hosted review set, and export a defensible record of what was preserved and produced—this workflow is what lets an organization respond to a subpoena or discovery request without relying on ad hoc searches of individual mailboxes and libraries.

🏏

Cricket analogy: It's like a match-fixing investigation freezing every recording, communication, and data log related to a specific match indefinitely, overriding the broadcaster's normal footage-deletion schedule until the investigation formally closes.

Retention and legal hold can coexist with multiple overlapping rules on the same item—for example, a document might be under a 7-year regulatory retention label, a site-wide 3-year retention policy, and a legal hold from an active eDiscovery case, all at once. When rules conflict, the 'principle of retention wins' generally applies: the strictest applicable rule (the one that keeps content the longest) governs, and deletion never happens until every applicable hold or retention rule has been satisfied or released.

powershell

# Create and apply a retention label using the Security & Compliance PowerShell module
Connect-IPPSSession -UserPrincipalName admin@contoso.com

# Create a 7-year retention label that also marks items as a Regulatory Record
New-ComplianceTag -Name "7Yr-RegulatoryRecord" -RetentionDuration 2555 -RetentionAction Keep -IsRecordLabel $true -RegulatoryRecord $true

# Publish the label to a specific SharePoint site
New-RetentionCompliancePolicy -Name "FinanceRecordsPolicy" -SharePointLocation "https://contoso.sharepoint.com/sites/FinanceHub"
New-RetentionComplianceRule -Policy "FinanceRecordsPolicy" -ApplyComplianceTag "7Yr-RegulatoryRecord" -RetentionDuration 2555

# Place a legal hold on a site as part of an eDiscovery case (run within a Purview eDiscovery case context)
New-CaseHoldPolicy -Case "Case-2026-0417" -Name "FinanceHubHold" -SharePointLocation "https://contoso.sharepoint.com/sites/FinanceHub"

Retention answers how long content must be kept; eDiscovery and compliance answer whether it can be found and produced when required.
Retention policies apply broadly to an entire location, while retention labels apply granularly to individual items with custom trigger events.
Records and Regulatory Records lock content against edits, with Regulatory Records blocking deletion by anyone until the period expires.
A retention hold overrides a user's own delete action, preserving a recoverable copy for the duration of the hold.
Legal holds via eDiscovery cases suspend normal retention and deletion rules for content relevant to litigation or investigation.
eDiscovery cases support cross-location search, hosted review, and defensible export for legal production.
When multiple retention rules or holds apply to the same item, the strictest rule governs and deletion waits for all to clear.

Practice what you learned

1. What is the primary difference between a retention policy and a retention label in SharePoint?

2. What happens if a user deletes a document that is currently under an active retention hold?

3. What makes a 'Regulatory Record' label the strongest compliance guarantee SharePoint offers?

4. What is the purpose of placing a legal hold on content through an eDiscovery case?

5. When a document is subject to both a 3-year retention policy and an active legal hold from an eDiscovery case, what governs whether it can be deleted?

Was this page helpful?

Information Governance

Site Provisioning