Understand data protection and governance tasks for Microsoft 365 and Copilot
Retention and Data Lifecycle Management
CoreTreat retention as its own competency: choose policies or labels, reason about retain/delete outcomes, and distinguish lifecycle from sensitivity and DLP.
Aligned to the current AB-900 guide, verified July 22, 2026.
Why this matters
AB-900 expects you to translate a keep/delete requirement into the right retention scope, duration, start condition, and end-of-period action.
Must Know
- Retention outcomes are retain, delete, or retain then delete; the requirement determines the outcome.
- A retention policy applies broad, consistent settings to supported locations or containers; a retention label applies item-specific lifecycle settings.
- Every retention duration needs both a length and a start point, such as creation, modification, labeling, or a defined event where supported.
- Use a retention label when selected content needs a distinct period, record behavior, event-based start, or disposition review.
- Disposition review is a human decision before final deletion for supported labeled content; it is not required for every retention policy.
- When content must be retained, users may remove the visible item while Microsoft 365 preserves a compliance copy.
- Sensitivity handles classification and protection; retention handles lifecycle. One item can need both.
Compare and Distinguish
- Retention policy vs retention label: broad location/container coverage vs item-specific lifecycle and richer end-of-period/record options.
- Retain vs delete vs retain then delete: preserve indefinitely/for a period vs remove when eligible vs preserve first and remove afterward.
- Sensitivity vs retention: classification/protection and access controls vs lifecycle keep/delete behavior.
- DLP vs retention: control risky use or movement vs preserve/delete content according to schedule.
- Retention vs eDiscovery hold: ongoing information-governance policy vs case/investigation preservation need.
Scenario examples
- Scenario: All mailboxes and SharePoint sites must keep ordinary business content for seven years. Think: Begin with a broad retention policy.
- Scenario: Final audit reports need ten years and human disposition review, while other finance content needs seven. Think: Combine broad policy coverage with a retention label for the special records.
- Scenario: A confidential file must be encrypted and deleted after five years. Think: Sensitivity handles encryption; retention handles the five-year lifecycle.
- Scenario: A user deletes a retained email before its period ends. Think: The user-facing item may disappear, but a protected compliance copy remains according to the retention configuration.
Exam traps
- A retention policy and a retention label are not interchangeable merely because both contain a duration.
- Retention does not encrypt content, remove oversharing, or block risky sharing unless another control performs that job.
- Disposition review is an end-of-period decision for supported labels, not a universal step for every retained item.
- A user deleting a retained item does not necessarily delete the protected compliance copy.
Key takeaways
- Broad location rule → policy; item-specific schedule/record/disposition → label.
- Define action, duration, start, scope, and end-of-period outcome.
- Sensitivity protects; classification detects; DLP controls risky use; retention keeps/deletes.
How it works
- The administrator defines scope, retention action, duration, and start condition. A policy applies to locations; a label applies lifecycle behavior to selected items and can travel within Microsoft 365 as documented.
- If retained content is edited or deleted, a protected copy remains in a workload preservation location. When the retention period ends, the configured action can leave, delete, relabel, or send supported labeled content for disposition review.
- Multiple retention settings can overlap. Preservation generally wins over deletion during the required period, and the longest retention period can control when settings conflict; administrators should use Microsoft’s retention principles rather than assuming the newest policy overrides all others.
Objects and administrative surfaces
- Retention policies, retention labels, label policies, events, disposition, and Data Lifecycle Management settings — Microsoft Purview portal.
- Records Management — Microsoft Purview for record declaration, disposition, file plans, and advanced record controls.
- Users may apply published labels in supported Exchange, SharePoint, OneDrive, and Microsoft 365 experiences.
When to use it
- Use a retention policy when a broad population or location needs one common rule.
- Use a retention label when item types need different schedules, event-based starts, record declaration, or disposition review.
- Use sensitivity and DLP alongside retention when the requirement also includes protection or control of risky movement; one control does not replace the others.
Security and governance implications
- Map retention settings to approved schedules and legal requirements, identify policy owners, and test before broad deployment.
- Restrict disposition and records roles because reviewers can make consequential deletion decisions and view sensitive metadata/content.
- Do not retain everything forever by default; unnecessary retention increases storage, privacy, and discovery risk.
Troubleshooting signals
- Confirm whether the item is governed by a policy, label, record setting, eDiscovery hold, or another overlapping retention rule.
- Check scope/location, publication/application, start date, duration, preservation location, and processing/propagation before expecting final deletion.
- If deletion is blocked, identify the controlling retention or hold before attempting removal; if content disappeared too early, verify that the intended policy actually applied.
More detail
- Retention exists to meet legal, regulatory, records, and business lifecycle requirements while reducing obsolete data. The core outcomes are retain-only, delete-only, and retain then delete after a defined period.
- A retention policy efficiently assigns the same settings to supported locations such as mailboxes, SharePoint sites, OneDrive accounts, Microsoft 365 groups, Teams messages, and Copilot experiences. Items inherit the container/location settings.
- A retention label assigns lifecycle settings to an individual email, document, or supported item. Labels can use different event/start conditions, be applied manually or automatically, mark items as records, and offer supported end-of-period actions such as disposition review.
- Retention duration includes both length and when the clock starts, such as creation, modification for supported locations, labeling, or a defined event. The correct choice depends on the requirement, not merely the number of years.
- When retention requires preserving content, Microsoft 365 keeps a compliance copy in a protected workload location if a user edits or deletes it. Users can often continue normal work while the retained copy remains discoverable for compliance.
- Disposition review is a human review at the end of a supported retention-label period before final deletion. It is useful for selected records that require a decision; it is not required for every retention policy.
- Records Management builds on retention labels when content needs record restrictions, file plans, proof of disposition, and stricter governance. AB-900 requires recognizing this relationship, not designing an expert records program.
Ready for the quiz?
- When is a retention policy better than a retention label?
- What four details should you identify in a retention requirement?
- When does disposition review make sense?
- Why can a user delete an item that is still retained?
- Why might one file need both sensitivity and retention?
Related objectives
- D2.1.a — Understand features and capabilities of Microsoft Purview Information Protection, Microsoft Purview Data Loss Prevention (DLP), Microsoft Purview Insider Risk Management, Microsoft Purview Communication Compliance, Microsoft Purview Data Security Posture Management (DSPM) for AI, and Microsoft Purview Data Lifecycle Management
- D2.1.d — Understand retention