Exchange Online Retention Policies, Holds, and DLP in Microsoft Purview: Design, Setup, and Testing

Retention is often sold as a cost saver. It is mainly a risk tool. You keep what the law, the contract, or the business requires, and you delete what you do not need to keep, because data you hold can be discovered in a lawsuit, breached, or requested by a regulator. The design work is deciding which is which, and writing it down.

Three Questions, Three Tools

Question	Tool	Where
What do we keep, and for how long?	Retention policies and labels	Purview, Data lifecycle management
What must we freeze for a legal matter?	Litigation hold, eDiscovery hold	Exchange admin center, Purview eDiscovery
What must not leave the organization?	Data loss prevention (DLP), sensitivity labels, encryption	Purview, Data loss prevention and Information protection
What can we restore if something is lost?	Backup	Not Purview; third-party or Microsoft 365 Backup

Mixing these up is the root of most failures. A retention policy is not a backup. DLP does not preserve anything. A hold is not a retention schedule.

Start With a Retention Schedule

Before opening the portal, write a short schedule:

1. List the record types that matter: finance and tax, HR and personnel, contracts, customer correspondence, health or safety records, legal files, general email.
2. For each, record the required period and the source (a law, regulation, contract term, or insurance condition). Get legal or compliance to confirm. Periods vary by country, industry, and record type.
3. Decide the trigger: when the item is created, when it was last modified, or when an event happens (employee leaves, contract ends).
4. Decide the end action: delete, review, or move to permanent archive.
5. Name an owner for each schedule line.
6. Decide for email whether you will use a blanket rule (for example, keep all email 7 years then delete) or per-type labels. A blanket rule is simpler and common in small and mid-sized organizations. Per-type labels need user or auto-labeling effort.

This schedule is your evidence if a regulator or court asks why data was or was not kept.

Create a Retention Policy

In the Microsoft Purview portal: Solutions, Data Lifecycle Management, Policies, Retention policies, New retention policy.

1. Name and description. Say why it exists: "Email 7 years - finance record retention."
2. Type. Choose *Adaptive* (scope follows attributes such as department or location) or *Static* (fixed lists of locations).
3. Locations. Choose Exchange mailboxes and any other services (SharePoint, OneDrive, Teams chats, Teams channel messages, Viva Engage) the policy covers. Include or exclude specific users or groups.
4. Settings. Choose Retain items for a specific period, Delete items after a period, or Retain and then delete. Choose the starting point: when created or when last modified.
5. Review and submit.

Behind the scenes, the Managed Folder Assistant applies the policy to each mailbox. A new policy can take up to seven days to apply everywhere. You can nudge a single mailbox:

When a user deletes an item that a policy retains, Exchange moves a copy to the hidden Recoverable Items folders (SubstrateHolds) for the retention period. The user sees the item gone; compliance tools can still find it. See recovering deleted email for how to search those hidden folders.

The Principles of Retention

Microsoft documents how multiple retention settings combine. In summary:

1. Retention wins over deletion. If one policy says delete after 3 years and another says retain for 7, the item is kept for 7 and deleted after.
2. The longest retention period wins when several policies retain the same item.
3. Explicit beats implicit. A retention label applied to an item takes precedence over a policy applied to the location, in specific ways Microsoft lists. Check the precedence rules in the documentation before relying on a label to override a policy.
4. Holds beat everything. An eDiscovery hold or litigation hold keeps items regardless of a delete rule.
5. The shortest deletion period wins among delete-only settings that do not conflict with retain settings.

Practical consequences: you cannot "delete sooner" for a mailbox just by adding a shorter policy if another policy retains longer. And before you trust a delete rule, identify every policy and hold that applies to the mailbox, using the policy lookup in Purview and Get-Mailbox | Format-List InPlaceHolds, LitigationHoldEnabled.

Start With Retain, Then Add Delete

Deletion is the dangerous half. The safe rollout:

1. Pilot with a small group of mailboxes, such as IT.
2. Deploy a retain only policy to everyone. Nothing is lost, and you begin preserving.
3. Review what is being kept. Check mailbox and Recoverable Items sizes after a few weeks.
4. Only after legal sign-off, add a delete after the period action.
5. Document the approval and date.

A policy that retains forever at the organization level can increase storage use and cost, because nothing ever leaves. A policy that deletes saves space only after the period ends. Retention should not be used as a substitute for a mailbox quota policy or archive plan.

Retention Labels and Records

A retention label is applied to an item or folder. Labels can:

• Retain for a period, delete after, or trigger a disposition review where a person approves deletion.
• Mark an item as a record (cannot be edited or deleted) or regulatory record (stricter, cannot be removed even by admins).
• Be applied manually by users, automatically by rules (keywords, sensitive information types, trainable classifiers), or by default on a folder or library.
• Be applied through Outlook to mail and folders (users right-click and choose *Assign Policy*).

Use labels for contracts, personnel files, and records with different periods. Publish only a small set that users can understand, and name them by business meaning ("Contract - 7 years"), not by the technical setting.

For mail, you can use auto-apply label policies with content conditions, such as messages containing contract numbers. Test the conditions in simulation mode first.

Legacy MRM Retention Tags

Before Purview, Exchange used Messaging Records Management with retention tags and retention policies attached to mailboxes. They still work and some tenants use them:

• Default Policy Tags apply to the whole mailbox.
• Retention Policy Tags apply to default folders such as Deleted Items or Junk Email.
• Personal Tags let users choose a tag for a folder or item.

Microsoft encourages moving to Purview retention for new designs. If you use both, remember that they combine under the principles above. Keep MRM only for folder-level housekeeping, such as deleting Deleted Items after 30 days, if you wish.

Litigation Hold and eDiscovery Holds

Holds are separate from retention and are for legal matters.

For formal matters use an eDiscovery (Standard or Premium) case in Purview: create the case, add custodians and data sources, place a hold, and run searches. Holds in cases can be query-based (preserve only matching content) or cover everything. Cases have members and are audited, so a record exists of who did what.

Key points:

• Placing a hold needs a license that supports it. A mailbox that has a hold, or an archive, or is over 50 GB in the shared mailbox case, needs Exchange Online Plan 2 or an equivalent. See shared mailboxes for the license cautions.
• Holds take effect from the time they are placed. They do not restore data already purged.
• Release holds when the matter ends, with legal's sign-off, so data can age out under the normal schedule.
• Document the hold in a register: matter, custodians, date placed, owner, expected release.

Archives, Auto-Expanding Storage, and Inactive Mailboxes

• Online archive. A second mailbox for older mail. Enable it for users who keep a lot of mail and for mailboxes on hold. Enabling needs a qualifying license.
• Auto-expanding archive grows the archive beyond 100 GB (to 1.5 TB) when needed, usually for mailboxes on hold. Enable it with Enable-Mailbox -AutoExpandingArchive (organization-wide: Set-OrganizationConfig -AutoExpandingArchive). Expansion can take time.
• Archive policy. A retention tag can move items to the archive after a period (the default MRM tag moves after two years).
• Inactive mailboxes. If a mailbox has a hold or retention policy and you delete the user, the mailbox is kept as an inactive mailbox for the hold period. This is the standard way to keep a leaver's mail without paying for a license. The hold must exist *before* deletion. List them with Get-Mailbox -InactiveMailboxOnly.

For a leaver you have three choices (convert to shared, license for hold, or inactive). The table and cautions are in the shared mailbox leaver section.

Retention and Storage Cost

Retention can reduce or increase cost, depending on how you use it:

• Increases storage when policies keep items that users delete, especially in Recoverable Items and archives, for mailboxes with a lot of churn.
• Reduces storage when you delete data at the end of its period, and when you stop paying for licenses by using inactive mailboxes for leavers.
• Reports show usage: Get-MailboxStatistics, Get-MailboxFolderStatistics -FolderScope RecoverableItems, and the usage reports in the admin center.
• Plan the mailbox quota (50 GB or 100 GB, depending on plan) and archive policy together with retention.

Data Loss Prevention (DLP)

DLP detects sensitive content and applies protection actions. In the Purview portal: Solutions, Data loss prevention, Policies, Create policy.

1. Choose a template or custom. Templates cover U.S. financial data, health information, GDPR, and many country-specific types, for example credit card numbers or national IDs.
2. Choose locations: Exchange email, SharePoint, OneDrive, Teams, Windows devices, and more.
3. Define conditions: content contains sensitive information types (with a count and confidence), shared with people outside the organization, or has a sensitivity label.
4. Define actions: show a policy tip to the sender, block or block with override, encrypt, send an incident report, or notify the compliance team.
5. Set the mode: start in simulation mode (test), then test with policy tips, then enforce.

Good DLP is tuned. Raise the threshold (for example, 10 credit card numbers instead of 1 for a block rule), use confidence levels, and exclude known-good senders. Too many false positives teach users to ignore warnings.

Examples worth building:

• Block or require business justification when email to outside recipients contains many credit card numbers.
• Encrypt mail that contains health data sent outside.
• Warn when a user emails a document labelled *Confidential* to a personal address.

Mail flow rules can do simple content checks without DLP licensing, but DLP is easier to manage and report on.

Sensitivity Labels and Encryption

Sensitivity labels classify and protect content with encryption, markings, and access limits:

• Users or policies apply a label ("Internal," "Confidential," "Highly Confidential").
• Labels can encrypt email and files, restrict forwarding, and expire access.
• DLP can use labels as conditions.

Microsoft Purview Message Encryption lets users send encrypted mail to recipients on any platform. Admins can set a mail flow rule to encrypt messages that match conditions, or users can choose *Encrypt* in Outlook. Be aware that encrypted mail is harder for some tools to read, including some archive and search tools.

Auditing and Reporting

• Audit (Standard or Premium) records user and admin actions, including mailbox access and policy changes. Retention of audit records depends on your license.
• Purview reports show retention label usage, DLP matches, and policy status.
• Activity explorer (with labels) shows which labels are used and where.
• Record policy changes. Anyone with admin rights can weaken retention, so restrict Purview roles and use approval and alerts for changes.

Roles and Separation of Duties

Purview roles include Compliance Administrator, eDiscovery Manager, Records Management, and Information Protection roles. Give them to few people, keep them separate from daily admin accounts, use Privileged Identity Management for just-in-time elevation, and review them. A global administrator who can remove a hold is a risk you should plan for.

Testing Before You Trust It

1. Create a test mailbox and apply your policy.
2. Add an item and delete it, then run the Managed Folder Assistant.
3. Use Content Search to confirm the deleted item is preserved.
4. For a delete policy, use a test item with a short period in a test policy, and confirm it is removed only after the expected time.
5. For DLP, send test messages with sample sensitive data to a test external address and confirm policy tips and blocks.
6. For inactive mailboxes, hold a test mailbox, delete the account, and practice searching and restoring.
7. Record the results, with dates.

How to Check It Worked

• The retention policy shows Success for the Exchange location in Purview, not *Pending* or *Error*.
• Get-Mailbox shows the expected holds and retention state.
• Content Search finds items that users deleted, inside the retention period.
• DLP reports show matches, and policy tips appear in test.
• Mailbox and Recoverable Items sizes are within quota after the first weeks.
• The hold register and retention schedule match what is configured.

Troubleshooting

Symptom	Likely cause
Policy pending or error	Propagation delay up to seven days, or a location conflict. Check the distribution status
Items not deleted after the period	Another policy, label, or hold retains them; the retain-wins principle applies
Mailbox storage grows quickly	Retention keeping deleted items, no archive. Enable the archive and auto-expansion
Recoverable Items full	Hold with no auto-expanding archive. Fix and run the Managed Folder Assistant
Cannot place hold	License lacks the feature
DLP flags too much	Thresholds too low or missing confidence settings. Tune in simulation mode
Users cannot send legitimate mail	DLP block too strict, and no override. Add business justification override
Label does not appear in Outlook	Label policy not published to that user, or an old client
Inactive mailbox missing	No hold at the time of deletion

A Short Decision Guide

• Keep email for N years: retention policy, retain then delete, after a pilot.
• A lawsuit is possible: eDiscovery hold, not a retention policy.
• Special records: retention labels.
• Leaver mail for years: hold, then inactive mailbox.
• Stop sensitive data leaving: DLP, in test first.
• Need to restore a mailbox: backup, not retention.

Related guides: recovering deleted email, shared mailboxes and leavers, and Exchange Online protection.

Retention periods are set by law and policy, not by this article, and the legal requirements vary by country and industry. Confirm them with legal counsel. Purview portal names, license requirements, and limits change often, and I have not tested these steps in your tenant. Check Microsoft's current documentation and pilot first. If you want help designing retention and DLP for a Microsoft 365 tenant, get in touch.