Microsoft 365 Retention facts

Microsoft 365 Retention Facts

In this age of GDPR it is essential to create a policy for data retention.  In fact I would advise creating this policy as one of the first jobs to do before migrating data to Microsoft 365.  It's important that you have a consistent approach to data wherever you store it.

One of the principles of GDPR is storage limitation.  Which is in essence not keeping data for longer than you require it for the purposes that is was intended and lawfully agreed to be used.  For more about GDPR take a look at the ICOs website:

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/

I've been asked a number of times now at the Microsoft 365 User Group www.m365ug.com and by colleagues about what data retention.  Specifically a question that pops up a few times is how retention works with deletion policies, what takes precedence?

It's a good question but rest assured Microsoft have us covered and your data won't go if it needs to be retained.  The following picture shows you the principles of data retention in Microsoft 365:

If you have two policies for Exchange email data, one that says delete after two years but another retention policy that says retain for 7 years.  The emails will be deleted and hidden from the users view after two years but retained in the Recoverable items folder but it will then be permanently deleted after 7 years.

If you have a policy that explicitly covers a specific users OneDrive this policy will take precedence over an implicit policy that covers the entire organisation.

If a user is subject to three policies to delete data then the deletion at the shortest period of time takes affect.  User A has a policy which deletes Teams channel messages after 5 years and another after 3 and another after 1 year.  The Teams channel messages will be deleted after 1 year.

Data retention covers data located in the following:

• Exchange mailboxes
• SharePoint sites
• OneDrive accounts
• Microsoft 365 groups
• Skype for Business
• Exchange public folders
• Teams (channel messages & chats)

Azure Information Protection, DLP alerting and Data retention are still hot topics for Andrew Bettany and myself when we talk to IT Pros.  We have both delivered presentations on these topics a number of times recently which proves how important it is to customers who need help with classifying, protecting, retaining and removing their data.  This topic can be a little confusing and maybe not as glamorous as rolling out Teams to your business but definitely more important to stay compliant.  Feel free to reach out to me on Twitter @MattFooks or pop along to the Microsoft 365 User Group in Leeds.