How to set up retention labels in Microsoft Purview

What this check looks at

Checks, from Microsoft Secure Score, that Microsoft Purview retention is set up, so records can be kept for as long as the law or contracts require and deleted after. Microsoft Graph does not let apps list retention labels or policies, so Secure Score is the source; where Purview is set up for the tenant, NL-PVW-108 to NL-PVW-110 read them directly.

Microsoft Purview retention has two parts. Retention policies apply one rule to a whole location (for example, keep all Exchange mail for seven years). Retention labels are applied to individual items by people or by rules (for example, "Financial records – 7 years"). Each can keep content for a period, delete it after a period, or both. Without either, Microsoft 365 keeps whatever nobody deletes and loses whatever someone does once the recycle bins empty: 14 days by default for Exchange’s recoverable items, 93 days for SharePoint and OneDrive.

Microsoft Graph does not let applications list retention labels or policies, so the check uses Microsoft Secure Score’s assessment of its retention actions, matched by name. It passes when Secure Score shows them all done, warns when any is not, and reports not checked when Secure Score does not track retention for the tenant. Where Purview is set up for the tenant, NL-PVW-108 to NL-PVW-110 read the retention policies and labels directly.

Two failures follow. Records the business must keep (accounts, payroll, contracts, HR files) can be deleted by anyone with edit access, by a leaver tidying up, by ransomware or by a malicious insider, and are gone for good once the recycle bins empty. And personal data the business no longer needs is kept indefinitely, against UK GDPR’s storage limitation principle, making every breach and every subject access request bigger.

Why it matters

Without retention, what is kept is down to whoever deletes what. That fails record-keeping duties (financial, HR, health) in one direction, and data minimisation under UK GDPR in the other.

A typical case: a finance manager leaves on bad terms and deletes a shared finance folder on the way out. Nobody notices for four months, until HMRC opens an enquiry and asks for invoices from two years ago. SharePoint’s 93-day recycle bin has emptied, and with no retention policy the records are gone.

HMRC expects company records to be kept for six years from the end of the financial year they relate to, and the Limitation Act 1980 gives six years for most contract claims. At the same time UK GDPR expects personal data to be deleted once it is no longer needed. Retention is how one system meets both duties.

This supports ISO 27001 A.5.33 (protection of records), PCI DSS 3.2.1 (keeping account data to a minimum through retention and disposal) and the NCSC Cyber Assessment Framework’s B3.c. Org-wide retention policies and manually applied labels are included with Business Premium and E3; applying labels automatically needs E5 or an add-on.

How to fix it

Where: Microsoft Purview portal → Data lifecycle management

Before you start

• Find out which records the business must keep and for how long (finance, HR, contracts).
• Check the licence: auto-applied labels need E5 or an add-on.

Step by step

1. 1Agree a simple retention schedule. With the business, list the record types it must keep and for how long: financial records six years after the year end, contracts six years after they end, HR files for the period its HR adviser recommends. Note anything that must be deleted after a period, such as unsuccessful candidates’ CVs.
2. 2Create an organisation-wide retention policy. In the Microsoft Purview portal, go to Solutions > Data Lifecycle Management > Policies > Retention policies and select New retention policy. Name it, keep Full directory and a static scope, and choose Exchange mailboxes, SharePoint classic and communication sites, OneDrive accounts and Microsoft 365 Group mailboxes & sites. Choose "Retain items for a specific period", seven years, based on when items were created, and at the end "Do nothing". Submit. Create a separate policy the same way for Teams channel messages and Teams chats.
3. 3Create retention labels for specific records. Go to Data Lifecycle Management > Retention labels > Create a label, for example "Financial records – 7 years": retain items for seven years from when they were created or last modified, then delete automatically (or do nothing, if the business prefers to decide later). Create one label per record type in your schedule.
4. 4Publish the labels. Go to Data Lifecycle Management > Policies > Label policies > Publish labels, choose the labels, and publish them to Exchange mailboxes, SharePoint classic and communication sites, OneDrive accounts and Microsoft 365 Group mailboxes & sites. Labels can take several days to appear in Outlook and SharePoint.
5. 5Set default labels on the libraries that hold records. In each finance, HR and contracts library, open the library settings and, under the retention label settings ("Apply label to items in this list or library"), choose the matching label, so new files are labelled without anyone remembering to.
6. 6Confirm the change. Connect to Security & Compliance PowerShell (Install-Module ExchangeOnlineManagement, then Connect-IPPSSession) as a Compliance Administrator. Get-RetentionCompliancePolicy -DistributionDetail | Select-Object Name, Enabled, DistributionStatus shows your policies enabled with distribution Success, and Get-ComplianceTag lists the labels. Within 48 hours the Secure Score retention actions show as completed.

What users will notice

Users see retention labels they can apply; labelled items cannot be deleted before the period ends.

How to confirm it worked

Microsoft Purview, Data lifecycle management, Retention labels: labels are published to the relevant locations.

Frameworks and controls

This check maps to controls in 8 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Learn about retention (Microsoft Learn)

Related checks

• How to publish sensitivity labels in Microsoft Purview
• How to keep email and files with Purview retention policies
• How to create sensitivity labels for documents and email
• How to publish retention labels in Microsoft Purview

The full Microsoft 365 security checklist, worst first