A former employee’s mailbox, a project SharePoint site and a finance folder can all hold business records long after they stop being actively used. If they are deleted too early, you may lose evidence, breach an obligation or disrupt a dispute. If they are kept forever, you increase storage costs, privacy exposure and the amount of data an attacker could access. Knowing how to set retention policies gives your organisation a controlled middle ground.
A retention policy is not simply an IT setting. It is a business rule enforced through technology: keep specific information for a defined period, then review or delete it in a controlled way. The right approach protects information that matters without turning Microsoft 365 or Azure into an unmanaged archive.
The most common mistake is choosing a single number – such as seven years – and applying it to every file, email and site. Different information carries different operational, legal and privacy requirements. An HR record, a client proposal, a patient-related document and a Teams chat should not automatically follow the same rule.
Begin by identifying the information your organisation creates and where it lives. For most small to mid-sized organisations, that includes Exchange Online mailboxes, SharePoint and OneDrive files, Teams messages, Microsoft 365 Groups, line-of-business data in Azure, and backups. Focus first on the information that would cause real harm if lost, exposed or retained unnecessarily.
For each category, document three decisions in plain English: what it is, why it must be retained, and what should happen when its retention period ends. Your finance, operations and people teams should help make these calls. IT can apply the controls, but it should not be left to decide recordkeeping obligations alone.
Australian organisations also need to consider privacy obligations, contractual commitments, industry rules and any requirements set by insurers or regulators. There is no universal retention schedule that suits every business. Where records have legal, tax, health or employment implications, obtain advice from the appropriate legal, compliance or accounting adviser before automating deletion.
Microsoft Purview provides retention features across core Microsoft 365 services. Depending on your licences and configuration, you can use retention policies to apply broad rules by workload or user group, and retention labels for more specific record categories.
A sensible starting point is to apply policies to well-defined areas rather than attempting a tenant-wide clean-up on day one. For example, you may retain all mail in selected finance mailboxes for an approved period, preserve documents in a contract management site, or apply a label to signed agreements that must be retained for longer than general project material.
Retention policies work well where a consistent rule applies to a location or group of users. They can cover Exchange mailboxes, SharePoint sites, OneDrive accounts and Teams content. Configure whether content should be retained, deleted, or retained first and deleted later.
The practical benefit is consistency. A new employee added to the relevant group receives the same protection without someone having to remember a manual process. The trade-off is that broad policies can retain low-value material alongside genuine records, so scope them carefully.
Retention labels are better suited to information that needs a distinct treatment. A label such as “Executed Contract” or “Personnel Record” can carry its own retention period and disposition action. Labels may be applied manually, by default to a library or folder, or automatically where your Microsoft 365 licensing and configuration support it.
Labels require user guidance. If staff do not understand when to apply them, important documents may remain unclassified. Keep label names clear and limited. A small, well-governed set is more useful than a long list of terms nobody can confidently choose from.
Retention is only half the decision. You must also define the end state. Some information can be deleted automatically after the approved period. Higher-risk records may require a disposition review, where an authorised person confirms whether they can be deleted or must be held longer.
Do not assume deletion is immediate. Microsoft services process retention actions in the background, and retained content may be preserved in locations not visible to everyday users. That is useful for compliance, but it makes careful testing and clear documentation essential.
Microsoft 365 retention settings do not automatically govern every workload in Azure. Azure storage accounts, databases, virtual machines, logs and application data each have their own lifecycle, backup and security considerations.
For Azure Storage, lifecycle management rules can move data to lower-cost tiers or delete eligible blobs after a defined period. This can control spend, particularly for logs, media, exports and older project data. However, lifecycle rules should never be treated as a shortcut for records management. Confirm that data is not subject to a retention requirement, legal hold or recovery need before it is removed.
For operational logs, decide what your team needs to investigate an incident, meet compliance expectations and understand system performance. Short retention may reduce cost, but it can leave you without evidence when a security incident is discovered months later. Longer retention improves visibility but requires a budget and access controls to match.
Backups need a separate retention schedule. A backup is designed for recovery after deletion, corruption or ransomware. A Microsoft 365 retention policy is designed to preserve and govern content. One does not replace the other. Your backup plan should specify recovery points, retention length, immutable protection where appropriate, restoration testing and who can authorise a restore.
Retention settings can interact in ways that are not obvious. A legal hold, eDiscovery hold or another retention configuration may prevent deletion even when a standard policy reaches its end date. In many cases, the rule that retains content for longer takes precedence.
This is why a policy register matters. Record each policy or label, its purpose, covered locations, owner, retention period, disposal action and approval date. Also record where legal or investigation holds are managed. This gives operations managers and leadership a readable view of what the organisation is retaining and why.
Avoid creating overlapping policies without a clear reason. Overlap is sometimes necessary, particularly for high-risk records, but accidental overlap creates confusion, unexpected storage growth and difficulty proving your controls work.
A policy that looks correct in a configuration screen can still produce an unwanted result in a live environment. Test with a small pilot group, a non-production site or carefully selected sample data. Confirm that staff can still access what they need, that labels appear where expected, and that end-of-retention actions match the approved schedule.
Use a structured test process:
Monitor the policy after deployment. Changes to Teams usage, SharePoint site structures, staff groups, licensing and Azure applications can all create gaps. A quarterly review is usually more useful than treating retention as a once-only project.
Retention policies fail when they belong vaguely to “IT”. Technology teams should administer Microsoft Purview, Azure lifecycle settings and backup controls, but business owners must remain accountable for the rules. Finance should own finance records, people leaders should own employment records, and operational leaders should own project or customer data categories.
Give each policy a named owner and a review date. Include retention status in regular governance reporting alongside security posture, backup success, device compliance and cloud spend. The report does not need to be technical. Leadership needs to know what is protected, what is due for review, where exceptions exist and whether any action is required.
For organisations without an internal Microsoft specialist, AZ Cloud Solutions can help translate approved business requirements into manageable Microsoft 365 and Azure controls, with reporting that makes the outcome clear.
The goal is not to retain every byte forever or delete data as quickly as possible. It is to make deliberate, documented decisions that support recovery, compliance, privacy and day-to-day work – then keep reviewing those decisions as your business changes.