Retention: Policies, Precedence & Recovery

Retention policies — blanket coverage

Creating a retention policy

Setting	What It Configures
Name and description	Admin-visible name and purpose
Scope type	Static (manual locations) or adaptive (dynamic query)
Locations	Exchange, SharePoint, OneDrive, Teams channels, Teams chats, Viva Engage, Teams private channels
Retain content	For a specific period (days/months/years) or forever
Delete content	After the retention period, at a specific date, or never
Retain and then delete	Keep for N years, then auto-delete

Location-specific behaviour

Location	How Retention Works	Where Content Is Preserved
Exchange	Emails preserved in Recoverable Items folder	SubstrateHolds subfolder
SharePoint/OneDrive	Files preserved in Preservation Hold Library	Hidden library in the site
Teams channels	Messages preserved in underlying Exchange mailbox	Group mailbox SubstrateHolds
Teams chats	Chat messages preserved in user’s mailbox	SubstrateHolds subfolder
Viva Engage	Messages preserved in Viva Engage storage	Hidden storage

The principles of retention

When multiple retention labels and policies apply to the same content, Microsoft Purview resolves conflicts using these principles (in order):

1. Retention wins over deletion

If one policy says “retain for 7 years” and another says “delete after 1 year,” the content is retained for 7 years. Keeping data always takes priority over deleting it.

2. Longest retention wins

If one label says “retain for 3 years” and a policy says “retain for 7 years,” the content is retained for 7 years. The longest period applies.

3. Explicit inclusion wins over implicit inclusion

If a policy explicitly includes a site and another policy implicitly includes it (via “all SharePoint sites”), the explicit policy’s settings take priority.

4. Shortest deletion wins (when no retention applies)

If multiple policies only delete (no retention), the shortest deletion period wins — content is deleted sooner.

The principles of retention resolve every conflict scenario

Scenario	Policy A	Policy B	Result
Retain vs delete	Retain 7 years	Delete after 1 year	Retain 7 years (retention wins)
Different retention	Retain 3 years	Retain 7 years	Retain 7 years (longest wins)
Label vs policy	Label: retain 5 years	Policy: retain 3 years	Retain 5 years (longest wins)
Delete only	Delete after 1 year	Delete after 3 years	Delete after 1 year (shortest deletion wins)
Retain then delete	Retain 5 years then delete	Retain 7 years then delete	Retain 7 years then delete

Policy lookup

Policy lookup is a tool in the Purview portal that shows which retention labels and policies apply to a specific item or location:

Feature	What It Does
Item-level lookup	Enter a specific document URL or email to see which labels and policies apply
Location-level lookup	See which policies target a specific site, mailbox, or group
Precedence resolution	Shows the effective retention outcome after applying all principles
Conflict identification	Highlights where multiple policies or labels overlap

💡 Exam tip: using Policy lookup

Policy lookup is the answer when exam questions ask “how can an admin determine which retention settings apply to a specific item?” or “how can you troubleshoot why content is being retained longer than expected?”

Key scenarios:

• Unexpected retention: Content is not being deleted when expected → Policy lookup shows a retention policy with a longer period
• Multiple policies: Admin wants to see the combined effect of all policies and labels on a mailbox
• Compliance audit: Demonstrate to auditors exactly which retention controls apply to regulated content

Recovering retained content

When users delete content that is under retention, it is not permanently gone. It’s preserved in hidden locations.

SharePoint / OneDrive recovery

Stage	Where Content Is	How to Recover
User deletes file	Site Recycle Bin (first-stage)	User restores from Recycle Bin
User empties Recycle Bin	Site Collection Recycle Bin (second-stage)	Site admin restores from second-stage Recycle Bin
Second-stage expired	Preservation Hold Library	Admin uses eDiscovery or compliance search to find and export

Exchange recovery

Stage	Where Content Is	How to Recover
User deletes email	Deleted Items folder	User restores from Deleted Items
User empties Deleted Items	Recoverable Items folder	User uses “Recover Deleted Items” in Outlook (14-day default)
Recoverable Items retention expired	SubstrateHolds (if retention policy applies)	Admin uses eDiscovery or Content search

The Preservation Hold Library

The Preservation Hold Library is a hidden library in SharePoint and OneDrive sites that stores copies of retained content:

• Invisible to users — they cannot see, access, or delete it
• Stores copies — when a user modifies or deletes a retained file, the original version is copied here
• Admin accessible — site collection admins and eDiscovery managers can access it
• Auto-cleanup — when the retention period expires, the preserved copy is permanently deleted

💡 Scenario: Priya recovers deleted trading records

A Meridian Financial trader accidentally deleted a folder of trading records from SharePoint. The records are under a 6-year retention policy.

Priya’s recovery path:

1. Check the Recycle Bin — files were deleted 3 days ago, still in first-stage Recycle Bin → restore directly
2. If not in Recycle Bin: check second-stage Recycle Bin → site admin restores
3. If not in second-stage: Preservation Hold Library → the retention policy preserved copies → use Content search to find and export
4. Result: All trading records recovered — retention policy saved the day

Question

What are the four principles of retention, in priority order?

Click or press Enter to reveal answer

Answer

1. Retention wins over deletion. 2. The longest retention period wins. 3. Explicit inclusion wins over implicit inclusion. 4. The shortest deletion period wins (when no retention applies). These resolve all conflicts between retention labels and policies.

Click to flip back

Question

What is the Preservation Hold Library?

Click or press Enter to reveal answer

Answer

A hidden library in SharePoint and OneDrive sites that stores copies of retained content. When users modify or delete a file under retention, the original is preserved here. It is invisible to users but accessible to admins and eDiscovery managers. Contents are auto-cleaned when the retention period expires.

Click to flip back

Question

What is Policy lookup used for?

Click or press Enter to reveal answer

Answer

Policy lookup shows which retention labels and policies apply to a specific item or location. It reveals the effective retention outcome after all precedence principles are applied, helping admins troubleshoot unexpected retention, verify compliance, and resolve policy conflicts.

Click to flip back

Knowledge Check

At Meridian Financial, a document in SharePoint has a retention label that says 'retain for 3 years' and is also covered by a retention policy that says 'retain for 7 years'. How long is the document retained?

A3 years — the retention label takes priority over policiesB7 years — the longest retention period winsC5 years — the average of the two retention periodsD10 years — both retention periods are added together

Check Answer

Knowledge Check

A user at Atlas Global deleted a confidential document from SharePoint 30 days ago. The Recycle Bin is empty and the second-stage Recycle Bin has been cleared. However, the document was under a 5-year retention policy. Can Zara recover it?

ANo — once the Recycle Bin is cleared, the document is permanently deletedBYes — the Preservation Hold Library stores a copy because the document was under retention, accessible via eDiscovery or Content searchCYes — but only if the document had a sensitivity label appliedDNo — retention policies only prevent deletion, they do not enable recovery

Check Answer

🎬 Video coming soon

---

Domain 2 complete! You now understand DLP policies, endpoint protection, and data retention.

Next up: Insider Risk: Foundations & Setup — Domain 3 begins with the threats that come from inside your organisation.