How to publish retention labels in Microsoft Purview

What this check looks at

Checks, in Microsoft Purview directly, that retention labels exist and that a label policy switched on publishes them for people to apply, or applies them automatically, so records the business must keep for a set time can be marked to be kept.

A retention label marks one item (an email, a document) to be kept for a set time, or kept and then deleted, whatever policy covers the rest of the mailbox or site. Labels are created in Microsoft Purview, but nobody can use one until a label policy publishes it to people (so it shows in Outlook, SharePoint and OneDrive), or applies it automatically to content that matches a rule.

The check reads the retention labels, the retention policies and their rules from Purview directly. It passes when at least one label is published or applied automatically by a label policy that is switched on, and names any label that is not. It fails when there are no retention labels at all, or when labels exist but no policy that is on publishes or applies any of them, and warns when the label policies came back without whether they are on.

Why it matters

A retention policy keeps everything for one period. Records with their own duty (payroll for six years, contracts for the length of a claim, health records for longer) need a label of their own. A label nobody can apply protects nothing, and records end up kept for the wrong time or not at all.

A retention policy keeps everything in a place for one period. Records with a duty of their own do not fit one period: payroll and tax records for six years after the year end, employment files for six years after someone leaves, health and safety records for longer. A label lets the business keep those for exactly as long as it must, and lets everything else go sooner, which UK GDPR’s storage limitation principle expects.

A typical case: an HR team is asked for a former employee’s disciplinary record during a tribunal claim, five years after they left. Without a label, the file was deleted in a clear-out two years earlier. Labelled "Employment records – 6 years after leaving", it could not have been deleted for good.

It supports ISO 27001 control A.5.33 (protection of records) and CIS Controls safeguard 3.4 (enforce data retention). Labels people apply themselves come with Microsoft 365 Business Premium and E3; applying them automatically needs E5 or an E5 Compliance add-on.

How to fix it

Where: Microsoft Purview portal → Data lifecycle management → Retention labels

Before you start

• List the kinds of records the business must keep for a set time (finance, HR, contracts) and the period for each.
• Check the licence: labels people apply themselves come with Business Premium and E3; applying them automatically needs E5 or an E5 Compliance add-on.

Step by step

1. 1List the records and their periods. Agree with the business the kinds of records it must keep for a set time (finance, HR, contracts, health and safety), the period for each, and when it starts: when the item was created, last changed, or labelled.
2. 2Create a retention label for each. In the Microsoft Purview portal, go to Solutions > Data lifecycle management > Retention labels and select Create a label. Name it after the record and period (for example "Financial records – 7 years"), choose "Retain items for a specific period", enter the period and choose "Do nothing" at the end unless deletion is agreed.
3. 3Publish the labels. Go to Data lifecycle management > Policies > Label policies and select Publish labels. Choose the labels, publish them to Exchange mailboxes, SharePoint sites, OneDrive accounts and Microsoft 365 group mailboxes and sites, name the policy and submit. Or choose Auto-apply a label where the records can be found by keyword or sensitive information type.
4. 4Or create them in PowerShell. Connect to Security & Compliance PowerShell (Install-Module ExchangeOnlineManagement, then Connect-IPPSSession) as a Compliance Administrator. Run New-ComplianceTag -Name "Financial records - 7 years" -RetentionAction Keep -RetentionDuration 2555 -RetentionType CreationAgeInDays, then New-RetentionCompliancePolicy -Name "Publish retention labels" -ExchangeLocation All -SharePointLocation All -OneDriveLocation All -ModernGroupLocation All and New-RetentionComplianceRule -Name "Publish retention labels" -Policy "Publish retention labels" -PublishComplianceTag "Financial records - 7 years".
5. 5Tell people and confirm the labels arrive. Published labels take up to a day to appear. Then Get-RetentionComplianceRule | Select-Object Name, Policy, PublishComplianceTag lists them, the policy shows as enabled, Outlook offers them under Assign policy, and the next assessment passes.

With PowerShell

Connect-IPPSSession
New-ComplianceTag -Name "Financial records - 7 years" -RetentionAction Keep -RetentionDuration 2555 -RetentionType CreationAgeInDays
New-RetentionCompliancePolicy -Name "Publish retention labels" -ExchangeLocation All -SharePointLocation All -OneDriveLocation All -ModernGroupLocation All
New-RetentionComplianceRule -Name "Publish retention labels" -Policy "Publish retention labels" -PublishComplianceTag "Financial records - 7 years"

What users will notice

People see the retention labels in Outlook, SharePoint and OneDrive and can apply them; labelled items cannot be deleted for good until the period ends.

How to confirm it worked

Get-RetentionComplianceRule | Select-Object Name, Policy, PublishComplianceTag lists the labels, and Get-RetentionCompliancePolicy shows that policy enabled; the labels appear in Outlook within a day.

Frameworks and controls

This check maps to controls in 6 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Create retention labels and apply them in apps (Microsoft Learn)
• Automatically apply a retention label (Microsoft Learn)

Related checks

• How to publish sensitivity labels in Microsoft Purview
• How to keep email and files with Purview retention policies
• How to fix retention policies that were not applied
• How to set up retention labels in Microsoft Purview

The full Microsoft 365 security checklist, worst first