How do we set up retention and records management in SharePoint?

Key facts

• Retention policies apply to whole locations; retention labels apply to individual items, folders or libraries.
• A record label can lock items against editing or deletion while retained.
• Retention keeps content in the Preservation Hold library when users delete or edit it during the retention period.
• Disposition review lets named reviewers approve deletion at the end of the retention period.
• Auto-applying labels by sensitive information, keywords or trainable classifiers needs higher licensing than manual labels.

Start with a retention schedule, not settings

Retention is a business and legal decision. Before touching Purview, write a short retention schedule: record categories such as Contracts, HR Personnel Files, Finance and Project Files, how long each is kept, what event starts the clock, and what happens at the end. Counsel and the business owners approve it.

Keep the first version small. Ten to twenty categories covers most small and mid-size organizations. A schedule with hundreds of categories rarely gets applied correctly by users.

Retention policies vs retention labels

Retention policies are broad. You apply them to SharePoint sites, OneDrive accounts, Exchange mailboxes or Teams, and everything in scope gets the same rule, such as keep for seven years after creation. They are the baseline that stops accidental early deletion.

Retention labels are specific. They are published to locations, then applied to items, either manually by users, as a default on a library or folder, or automatically. Labels can retain, delete, or retain then delete, and can start the clock on an event such as an employee leaving or a contract ending.

Records and how to apply labels

A retention label can declare items as records, which blocks deletion and restricts some edits while the label applies, or as regulatory records, which are stricter and cannot be removed even by admins. Use regulatory records only when a regulation requires it, because the restrictions are hard to undo.

The most reliable way to apply labels is as a library default: everything saved into the HR Personnel library gets the HR label. Auto-apply policies can label content that matches sensitive information types, keywords or trainable classifiers, but those features require higher Purview licensing, so confirm what your plan includes.

• Set default labels on libraries built for one record type.
• Let users apply labels manually where documents are mixed.
• Use auto-apply where licensing allows and accuracy is tested.
• Use event-based labels for employee, contract and project lifecycles.

What happens behind the scenes

When retained content is edited or deleted during its retention period, SharePoint keeps a copy in the site's Preservation Hold library. Users do not see it, but eDiscovery and admins can. This can increase site storage, so watch quota on busy sites.

At the end of the retention period, content can be deleted automatically or sent to disposition review. Reviewers get a task in the Purview portal and approve, extend or relabel each item. Proof of disposition is kept for audit.

A sensible rollout order

First, apply a baseline retention policy that matches your shortest legal minimum. Second, publish a small set of labels and set library defaults on the sites that hold formal records. Third, train owners of those sites. Fourth, add event-based and auto-apply labels once the basics work. Finally, set disposition reviewers and test a disposition cycle on sample content.

Document every policy and label in the retention schedule, and review it yearly. Retention settings applied without records are hard to defend in an audit.

How Accred Consulting approaches it

Accred Consulting configures Microsoft Purview retention for SharePoint, OneDrive, Exchange and Teams; the client and its counsel own the retention schedule and compliance decisions. Discovery reviews current sites, record types, legal holds and licensing, and the proposal sets scope, fixed price and timeline. The US-based specialists assigned to your engagement build retention policies, labels, library defaults, event-based retention and disposition review, then test them on sample content. Handover includes documentation and knowledge transfer, with optional support retainers.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions