Retention for Exchange, OneDrive for Business, and SharePoint Online

Atle Skjekkeland


An important M365 design decision is to determine if all information should have a lifecycle, not just records. Research by the Compliance Governance & Oversight Council found that in average, 25% of information has business value, 5% is subject to regulatory record keeping requirements, 2% is subject to legal hold, and 68% is redundant, outdated, and trivial (ROT). Applying retention for non-business and regulatory records will reduce your ROT, which will reduce search results clutter, reduce storage requirements, and reduce your eDiscovery or FOIA costs. Information Governance is therefore the first and important step i the EDRM reference model for effective search, investigations, and eDiscovery.

EDRM Reference Model

Before implementing retention for ROT and non-records in M365, you need to ensure that you have a good way to classify and manage records.

Retention for Records

At Infotechtion, we often help clients to modernize their retention requirements into big-bucket retention categories for making it easier for people and machines to select the right retention. Below are two ways – manual and automatic – to do this in M365 for collaborative spaces.

M365 retention for records

For static and archived sites, we often automate the identification and classification of records.

M365 automated records management

To learn more about Microsoft Records Management, check out this blog post.

Retention for Non-Records

Some M365 users end up storing important business information in Outlook and OneDrive for Business. If the business consider email and OneDrive personal spaces that the employer can´t access, then this means business information will be lost when the employee leaves the organization. Opening up access to personal spaces to line managers for a specific time period after employees leaves will not fix the issue since line managers are too busy to manually review personal spaces for corporate information. Storing the personal spaces forever after employees leaves will also not work since this usually creates a GDPR problem.

The best approach is often to add retention for personal spaces and educate employees about the importance of storing business information in corporate spaces like SharePoint Online sites or group emails. The key is to get business information out of personal spaces into corporate spaces. Applying retention for personal spaces will provide users with an incentive to store long-term information in long-term corporate spaces.

If you do not have retention enabled for personal spaces and non-records, then we recommend to start with a 3-year retention policy. Once this has matured, then reduce it even more.

M365 retention for non records

The benefits of implementing this:

  • Get rid of redundant, outdated, and trivial information (ROT)

  • Reduce storage requirements

  • Reduce search results clutter

  • Reduce eDiscovery and FOIA costs

  • Provide users with an incentive to store long-term information in long-term corporate spaces

Please remember to provide users with 3-6 months warning before implementing non-records retention. This gives users time to clean-up their personal spaces and to move business information over to corporate spaces.

M365 also has compliance features to automatically detect sensitive information stored outside dedicated corporate spaces, e.g., HR sites. This can not only warn or stop users from sending or saving sensitive information like social security numbers, credit card numbers, resumes, etc, but also auto-apply retention and deletion for pre-existing and new sensitive information found in Exchange, SharePoint, and OneDrive for Business. You have machine learning and 200+ out-of-the-box templates available to identify sensitive information – and then auto-apply retention, e.g, auto-delete resumes found outside dedicated HR sites after 6 months.

M365 Sensitive Information Types

Feel free to contact us if you need help establishing retention for both records and non-records.

 © 2024 Infotechtion. All rights reserved 


By submitting this form you agree that Infotechtion will store your details and send future resources. You may opt-out any time.

Recent posts

Job application.

Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorestandard dummy text ever since.

Please fill the form

Job application.

Join Infotechtion for an impactful career filled with passion, innovation, and growth. Embrace diversity, collaboration, and continuous learning. Discover your potential with us. Exciting opportunities await!

Please fill the form

By submitting the form, you confirm that you do not require a visa sponsorship to work in the country of application.