How to keep email and files with Purview retention policies

What this check looks at

Checks, in Microsoft Purview directly, that retention policies switched on keep Exchange email, SharePoint sites and OneDrive accounts for everyone, so content deleted by a person, a leaver’s clean-up or an attacker can still be recovered for the time the policy sets.

A retention policy in Microsoft Purview keeps content in the places it covers for a set time, whatever happens to it there. Someone can still delete an email or a file, and it leaves their view as before, but Microsoft 365 keeps a copy out of sight (in the mailbox’s Recoverable Items folder, or the site’s Preservation Hold library) until the period ends, where an administrator can recover it or find it with a search.

Without one, deletion is final once the recycle bins empty: about 14 days for an Exchange mailbox (30 at most), and 93 days for SharePoint and OneDrive. After that nothing Microsoft keeps can bring the item back.

The check reads the retention policies and their rules from Purview directly. It counts a policy that is switched on and has a rule that keeps content (Keep, or Keep then delete), and leaves out policies that only publish or apply retention labels. It passes when such policies keep Exchange email, SharePoint sites and OneDrive accounts for everyone (each location set to All), and says whether Teams chats and channel messages are kept too. It fails when a location is not kept for everyone, and warns when a policy came back without whether it is on.

Why it matters

Without a retention policy, an email or file someone deletes is gone for good once the recycle bin empties (about two weeks for mail, 93 days for files). A mailbox emptied by an attacker, a disgruntled leaver’s deleted folder or records the business must keep for six years cannot be brought back, and there is nothing to search when a dispute or a subject access request comes in.

A typical case: an attacker who has taken over a finance mailbox deletes the sent invoices and the replies from the customer to hide a payment fraud, then empties Deleted Items. A month later, when the customer calls, the evidence is gone. With a retention policy on Exchange, every one of those messages can be found with a content search and restored.

The same goes for a leaver who deletes their OneDrive on the way out, a ransomware clean-up that loses a SharePoint library, or a dispute that needs the emails of three years ago. Many businesses must also keep financial, employment and contract records for six years or more: a retention policy is how Microsoft 365 meets that duty, rather than trusting people not to delete.

It supports ISO 27001 control A.5.33 (protection of records) and CIS Controls safeguard 3.4 (enforce data retention). Retention policies for Exchange, SharePoint and OneDrive come with Microsoft 365 Business Premium, E3 and E5, and Office 365 E3 and E5.

How to fix it

Where: Microsoft Purview portal → Data lifecycle management → Policies → Retention policies

Before you start

• Agree with the business how long email and files must be kept (six or seven years is common for financial records) and whether anything should be deleted at the end.
• Check no other policy or hold already covers the same locations with a shorter period: the longest retention wins, so a new policy never shortens one.

Step by step

1. 1Agree how long to keep email and files. Ask the business how long it must keep email and documents (six or seven years for financial records is common), and whether anything should be deleted at the end. If nobody has decided, keep content and do nothing at the end: a policy that only keeps never deletes anything.
2. 2Create the retention policy. In the Microsoft Purview portal, go to Solutions > Data lifecycle management > Policies > Retention policies and select New retention policy. Name it (for example "Keep email and files – 7 years"), choose Static as the scope type, and turn on Exchange mailboxes, SharePoint classic and communication sites and OneDrive accounts, each with All users or All sites.
3. 3Set the period and what happens at the end. Choose "Retain items for a specific period", enter the period (for example 7 years), start it from when items were created, and choose "Do nothing" at the end unless the business has agreed to delete. Review and submit.
4. 4Add Teams if it holds records. Teams chats and channel messages need a policy of their own: create a second retention policy with Teams channel messages and Teams chats turned on for everyone, with the same period.
5. 5Or create it in PowerShell. Connect to Security & Compliance PowerShell (Install-Module ExchangeOnlineManagement, then Connect-IPPSSession) as a Compliance Administrator. Run New-RetentionCompliancePolicy -Name "Keep email and files" -ExchangeLocation All -SharePointLocation All -OneDriveLocation All, then New-RetentionComplianceRule -Name "Keep 7 years" -Policy "Keep email and files" -RetentionDuration 2555 -RetentionComplianceAction Keep.
6. 6Confirm the policy is applied. A new policy can take up to a day to reach every location. Then Get-RetentionCompliancePolicy | Select-Object Name, Enabled, DistributionStatus, ExchangeLocation, SharePointLocation, OneDriveLocation shows it enabled, with Success and All in each location, and the next assessment passes.

With PowerShell

Connect-IPPSSession
New-RetentionCompliancePolicy -Name "Keep email and files" -ExchangeLocation All -SharePointLocation All -OneDriveLocation All
New-RetentionComplianceRule -Name "Keep 7 years" -Policy "Keep email and files" -RetentionDuration 2555 -RetentionComplianceAction Keep

What users will notice

None day to day. Deleted email and files disappear from view as before, but are kept out of sight and can be recovered or searched until the period ends.

How to confirm it worked

Get-RetentionCompliancePolicy | Select-Object Name, Enabled, ExchangeLocation, SharePointLocation, OneDriveLocation shows an enabled policy with All in each, and Get-RetentionComplianceRule -Policy "<policy>" shows a Keep action and its duration.

Frameworks and controls

This check maps to controls in 6 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Learn about retention policies and retention labels (Microsoft Learn)
• Create and configure retention policies (Microsoft Learn)

Related checks

• DLP across email, SharePoint, OneDrive, Teams and devices
• How to publish retention labels in Microsoft Purview
• How to publish sensitivity labels in Microsoft Purview
• How to fix retention policies that were not applied

The full Microsoft 365 security checklist, worst first