Retention and litigation hold in Microsoft 365: it is not a backup
Legal obligations require some content to be kept for years and other content to be deleted as soon as it is no longer needed. Microsoft Purview provides tools for both, provided you understand how they work and where their limits lie.
Retain, delete, or both
A retention setting can:
- retain content for a given period, even if the user deletes it;
- delete content after a given period;
- retain then delete, the most common case to meet both archiving obligations and the GDPR data minimisation principle.
When several settings apply to the same content, Microsoft applies the principles of retention: retention wins over deletion, and the longest retention period prevails.
Retention policies or retention labels
| Retention policy | Retention label | |
|---|---|---|
| Scope | A whole location (mailboxes, sites, Teams) | A specific item or folder |
| Applied | Automatically across the location | Manually, as a library default, or automatically depending on licence |
| Typical use | Organisation-wide baseline | Business exceptions, contracts, HR files, records |
A common approach combines a broad policy for the baseline with a few labels for document categories subject to specific periods.
Where retained content goes
For SharePoint and OneDrive, retained versions and deleted files are copied to the site's Preservation Hold library, which consumes storage quota. For Exchange, content stays in the mailbox's Recoverable Items folder. Teams messages are kept in a hidden folder in the relevant mailboxes. These locations are not designed for user self-service restores.
Litigation hold and eDiscovery
Litigation hold on a mailbox (Set-Mailbox -LitigationHoldEnabled $true) preserves all of its content, indefinitely or for a set duration. eDiscovery holds, attached to a case, target specific people, sites or queries for an investigation or legal proceeding. They must be released when the case closes, otherwise they accumulate and block planned deletions.
Do not confuse them. Retention preserves content for compliance purposes; it cannot restore a site or mailbox to yesterday's state after ransomware encryption or a faulty script. That requires a backup solution, whether Microsoft's offering or a third-party tool.
Why it is not a backup
- No point-in-time restore: you recover items, not a structure.
- Recovery goes through eDiscovery searches and exports, which are slow and manual.
- Permissions, site structure and settings are not preserved.
- A retention misconfiguration can itself delete content.
What an audit checks
- Whether a retention policy covers the main locations.
- Deletion policies and their consistency with legal obligations.
- Active litigation and eDiscovery holds, and their justification.
- Whether a separate backup solution exists.