🔒 Guided

Pre-launch preview. Authorised access only.

Incorrect code

Guided by A Guide to Cloud
Explore AB-900 AI-901
Guided MS-102 Domain 4
Domain 4 — Module 2 of 5 40%
25 of 28 overall

MS-102 Study Guide

Domain 1: Deploy and Manage a Microsoft 365 Tenant

  • Establish and Configure Your M365 Tenant
  • Monitor Tenant Health and Network Readiness
  • Adoption Tracking and Microsoft 365 Backup
  • Manage Users, Contacts and External Identities
  • Groups, Shared Mailboxes and Licensing at Scale
  • Automate with PowerShell: Bulk User Operations
  • Roles, Role Groups and Workload Permissions
  • Delegate with Administrative Units and PIM

Domain 2: Implement and Manage Microsoft Entra Identity and Access

  • Prepare for Identity Synchronization
  • Implement Connect Sync and Cloud Sync
  • Monitor and Troubleshoot Identity Sync
  • Authentication Methods and Self-Service Password Reset
  • Password Protection and Authentication Troubleshooting
  • Entra Identity Protection and Risk Policies
  • Conditional Access and MFA Enforcement

Domain 3: Manage Security and Threats by Using Microsoft Defender XDR

  • Defender XDR: Security Posture and Threat Intelligence
  • Investigate Incidents with Advanced Hunting
  • Defender for Office 365: Threat Policies
  • Email Threats, Attack Simulation and Restricted Entities
  • Defender for Endpoint: Onboard and Protect
  • Vulnerability Management
  • Defender for Cloud Apps: Connect and Govern
  • Cloud App Discovery and Activity Monitoring

Domain 4: Manage Compliance by Using Microsoft Purview

  • Sensitive Information Types and Data Classification
  • Retention Labels and Data Lifecycle
  • Sensitivity Labels and Monitoring
  • DLP Policies Across M365 Workloads
  • Endpoint DLP and Alert Response

MS-102 Study Guide

Domain 1: Deploy and Manage a Microsoft 365 Tenant

  • Establish and Configure Your M365 Tenant
  • Monitor Tenant Health and Network Readiness
  • Adoption Tracking and Microsoft 365 Backup
  • Manage Users, Contacts and External Identities
  • Groups, Shared Mailboxes and Licensing at Scale
  • Automate with PowerShell: Bulk User Operations
  • Roles, Role Groups and Workload Permissions
  • Delegate with Administrative Units and PIM

Domain 2: Implement and Manage Microsoft Entra Identity and Access

  • Prepare for Identity Synchronization
  • Implement Connect Sync and Cloud Sync
  • Monitor and Troubleshoot Identity Sync
  • Authentication Methods and Self-Service Password Reset
  • Password Protection and Authentication Troubleshooting
  • Entra Identity Protection and Risk Policies
  • Conditional Access and MFA Enforcement

Domain 3: Manage Security and Threats by Using Microsoft Defender XDR

  • Defender XDR: Security Posture and Threat Intelligence
  • Investigate Incidents with Advanced Hunting
  • Defender for Office 365: Threat Policies
  • Email Threats, Attack Simulation and Restricted Entities
  • Defender for Endpoint: Onboard and Protect
  • Vulnerability Management
  • Defender for Cloud Apps: Connect and Govern
  • Cloud App Discovery and Activity Monitoring

Domain 4: Manage Compliance by Using Microsoft Purview

  • Sensitive Information Types and Data Classification
  • Retention Labels and Data Lifecycle
  • Sensitivity Labels and Monitoring
  • DLP Policies Across M365 Workloads
  • Endpoint DLP and Alert Response
Domain 4: Manage Compliance by Using Microsoft Purview Premium ⏱ ~15 min read

Retention Labels and Data Lifecycle

Implement retention labels, retention label policies, and retention policies to manage how long content is kept and when it's disposed of.

Managing data lifecycle at scale

☕ Simple explanation

Every piece of data has a lifecycle: it’s created, used, and eventually either archived or deleted. Retention policies make sure this happens automatically — keeping data when regulations require it and deleting it when it’s no longer needed.

Think of a hospital’s record-keeping: patient records must be kept for 7 years after the last visit (legal requirement), but old marketing emails can be deleted after 1 year (no legal requirement to keep them). Retention policies enforce these rules automatically across millions of documents.

Microsoft Purview provides two mechanisms for retention:

  • Retention policies — broad, location-based rules that apply to all content in a workload (e.g., “keep all Exchange email for 3 years”)
  • Retention labels — granular, item-level labels that apply to individual documents or emails (e.g., “this contract must be retained for 7 years”)

Both can retain content, delete content, or retain then delete. They work together — a retention label on a specific document overrides the retention policy for that item (label settings take precedence for the item it’s applied to).

Retention policies vs retention labels

Retention Policies vs Retention Labels
FeatureRetention PoliciesRetention Labels
ScopeEntire workloads or locationsIndividual items (documents, emails)
Applied toExchange, SharePoint, OneDrive, Teams, Viva EngageSpecific documents, emails, or folders
Application methodAutomatic — applies to all content in scopeManual (user-applied) or automatic (based on conditions)
Declare as recordNoYes — can mark items as records or regulatory records
Disposition reviewNoYes — reviewers can approve deletion at end of retention
File plan supportNoYes — structured file plan descriptors
OverrideLabel settings take precedence for labeled itemsLabel always wins over policy for that item
💡 Exam tip: The Principles of Retention

When multiple retention policies or labels apply to the same content, Microsoft Purview follows these four principles (in order):

  1. Retention wins over deletion — if any policy retains, the content is kept even if another policy would delete it
  2. Longest retention period wins — if multiple policies retain for different periods, the longest period applies
  3. Explicit deletion wins over implicit — an explicit “delete after X years” takes precedence over no deletion action
  4. Shortest deletion period wins — if multiple policies delete, the shortest deletion period applies

The exam loves scenarios where a 3-year policy and a 7-year policy both apply. Answer: content is retained for 7 years (longest wins). If a retention label says “delete after 5 years” and a policy says “retain for 10 years,” the content is retained for 10 years (retention wins over deletion).

Retention policies

Creating a retention policy

Elena creates a retention policy for MedGuard Health’s Exchange mailboxes:

SettingValueWhy
Name”MedGuard Email Retention — 7 Years”Descriptive, follows naming convention
LocationsExchange email — all usersApplies to every mailbox
Retain itemsFor 7 yearsHealthcare regulation requirement
After retention periodDelete items automaticallyNo need to keep beyond 7 years
Retention startWhen items were createdBased on email received date

What retention policies do behind the scenes

When a user deletes an email that’s under a retention policy:

  1. Email moves to Deleted Items (user sees this)
  2. User empties Deleted Items → email moves to Recoverable Items folder (hidden)
  3. Email stays in Recoverable Items until the retention period expires
  4. After retention period → email is permanently deleted

The user thinks they deleted the email. Compliance knows it’s still there.

💡 Exam tip: Retention for Teams messages

Teams retention works differently from Exchange:

  • Teams messages are stored in a hidden folder in the user’s mailbox (for 1:1 chats) or the group mailbox (for channel messages)
  • When a user deletes a Teams message, it disappears from the UI but remains in the hidden folder until the retention period expires
  • Retention policies for Teams apply to both chat messages and channel messages (configured separately)
  • Teams messages do NOT go to the Deleted Items folder — they go directly to a hidden compliance folder

The exam may ask: “A user deletes a Teams message. Is it recoverable?” → Yes, if a retention policy covers Teams messages.

Retention labels

Publishing labels vs auto-applying labels

MethodHow It WorksBest For
Publish labelsLabels are published to locations (Exchange, SPO, OD). Users manually apply them.Documents where users know the classification (contracts, policies)
Auto-apply labelsLabels are automatically applied based on conditions (SITs, keywords, trainable classifiers)High-volume content where manual labeling is impractical

Auto-apply conditions

ConditionExampleUse Case
Sensitive information typesApply “Patient Record” label when content contains patient IDsHealthcare data
Keywords or phrasesApply “Legal Hold” label when content contains “litigation” or “lawsuit”Legal department
Trainable classifiersApply “Financial Statement” label to documents matching the financial classifierFinance department
Cloud attachmentsApply labels to files shared via Teams or OutlookCollaboration content

Records management

Retention labels can declare items as records or regulatory records:

TypeWhat It MeansCan Be ModifiedCan Be Deleted
Standard itemNormal retention — retained but can be modified/deleted by usersYesYes (retained behind the scenes)
RecordLocked for editing but can be unlocked by adminsNo (unless unlocked)No (until retention expires)
Regulatory recordImmutable — cannot be modified or deleted by anyoneNoNo (not even admins)

Elena uses regulatory records for patient consent forms — these must be absolutely immutable for healthcare compliance.

ℹ️ Deep dive: Disposition review

When a retention label has disposition review enabled, content doesn’t automatically delete at the end of the retention period. Instead:

  1. A disposition reviewer receives a notification
  2. The reviewer examines the content
  3. The reviewer approves deletion, extends retention, or applies a different label
  4. An audit trail records the decision

This is critical for regulated industries where a human must approve data destruction. Elena configures disposition review for all patient records — a compliance officer must approve deletion even after the 7-year period.

Key concepts to remember

Question

What is the difference between a retention policy and a retention label?

Click or press Enter to reveal answer

Answer

Retention policies apply broadly to entire locations (all email in Exchange, all files in SharePoint). Retention labels apply to individual items and can be manually or automatically applied. Labels can also declare items as records. When both apply to an item, the label's settings take precedence.

Click to flip back

Question

What happens when a user deletes an email that is under a retention policy?

Click or press Enter to reveal answer

Answer

The email moves to Deleted Items, then to the Recoverable Items folder (hidden from the user). It remains there until the retention period expires, then is permanently deleted. The user sees the email as deleted; compliance knows it's preserved.

Click to flip back

Question

What is the difference between a record and a regulatory record in Purview?

Click or press Enter to reveal answer

Answer

A record is locked for editing (but can be unlocked by admins) and cannot be deleted until retention expires. A regulatory record is completely immutable — it cannot be modified or deleted by anyone, including admins. Use regulatory records for content that must be preserved without any possibility of alteration.

Click to flip back

Question

What is disposition review?

Click or press Enter to reveal answer

Answer

A workflow where a human reviewer must approve the deletion of content at the end of its retention period, instead of automatic deletion. The reviewer can approve deletion, extend retention, or relabel. Required in regulated industries where data destruction must be auditable.

Click to flip back

Knowledge check

Knowledge Check

Elena needs to ensure that MedGuard Health's patient consent forms are kept for exactly 7 years and cannot be modified or deleted by anyone — including admins — during that period. What should she configure?

Knowledge Check

Marcus wants to keep all Oakwood Financial emails for 3 years, then automatically delete them. He also wants specific contracts to be retained for 10 years. How should he configure this?

🎬 Video coming soon


Next up: Sensitivity Labels and Monitoring — classifying and encrypting content based on its sensitivity.

← Previous

Sensitive Information Types and Data Classification

Next →

Sensitivity Labels and Monitoring

Guided

I learn, I simplify, I share.

A Guide to Cloud YouTube Feedback

© 2026 Sutheesh. All rights reserved.

Guided is an independent study resource and is not affiliated with, endorsed by, or officially connected to Microsoft. Microsoft, Azure, and related trademarks are property of Microsoft Corporation. Always verify information against Microsoft Learn.