Retention Policies in SharePoint Online: What They Are & How to Apply Them?

In today's digital workspace, organizations deal with vast amounts of data daily. Managing this data effectively is not only essential for ensuring productivity but also for maintaining compliance with regulatory requirements. One of the best tools for achieving this in SharePoint Online is retention policies.

In SharePoint Online, retention policies help organizations automatically retain, delete, or archive content in a manner that complies with legal, regulatory, and organizational needs. These policies can be applied to ensure content is kept for the required period, while also safeguarding sensitive information by removing or archiving it after a specific timeframe.

In this guide, we will explain what retention policies in SharePoint Online are, why they are important, and how to apply them effectively to ensure your organization’s data management is compliant, efficient, and secure.

What Are Retention Policies in SharePoint Online?

Retention policies in SharePoint Online are rules that help organizations manage how long content is kept within the system before it’s either deleted or archived. These policies can be set at different levels of granularity, including:

• Site collections
• Document libraries
• Lists
• Items (e.g., documents, files)

Retention policies help enforce compliance with regulations such as GDPR, HIPAA, and other legal requirements that mandate how long records must be kept before they can be safely disposed of.

There are two main actions that retention policies can automate:

• Retain: Keeping the content for a specified period.
• Delete: Removing the content after a certain period.

These policies can be applied based on different criteria, such as the type of content, the content’s age, or whether the content has been modified.

Related article: Create a Document Library in SharePoint Online

Why Are Retention Policies Important in SharePoint Online?

Retention policies in SharePoint Online serve several critical purposes for organizations:

1. Compliance with Regulations: Different industries require specific retention periods for certain types of content. For instance, financial records may need to be retained for seven years, while other records may need to be disposed of after a shorter period. Retention policies help organizations comply with these requirements.

2. Data Security: Automatically deleting or archiving content after a set period reduces the risk of sensitive information being exposed or misused. It ensures that old and unnecessary documents are not retained longer than needed.

3. Storage Optimization: Retention policies help reduce the volume of content stored on SharePoint by automatically removing outdated or unneeded files. This can help reduce storage costs and improve the performance of SharePoint sites.

4. Minimizing Legal Risk: Retention policies reduce legal risk by ensuring that records are kept for the required amount of time and deleted after they are no longer needed. This can help an organization avoid eDiscovery challenges or legal actions related to the retention of certain data.

Types of Retention Policies in SharePoint Online

There are two main types of retention policies in SharePoint Online:

1. Retention Policies

A retention policy is a rule set up in the Microsoft 365 Compliance Center that can apply to content across multiple locations such as SharePoint, OneDrive, Microsoft Teams, and Exchange.

Retention policies can either:

• Retain content for a specific period (e.g., 3 years).
• Delete content after a certain retention period has passed (e.g., 5 years).

Retention policies can be applied across the whole organization or targeted at specific sites, libraries, or items.

2. Retention Labels

Retention labels are individual tags that are applied to content in SharePoint Online. A label contains retention settings that dictate how long content should be kept and what should happen after that period expires. Labels are ideal for more granular control over specific content types or departments.

Example: A legal department might apply a retention label to contracts that require them to be retained for seven years, after which they are automatically deleted.

Must read: SharePoint Document Management Best Practices

How Retention Policies Work in SharePoint Online?

Retention policies are applied and managed through the Microsoft 365 Compliance Center. Once you create a retention policy, you can choose to apply it across different services, such as SharePoint Online, OneDrive for Business, Exchange Online, and Microsoft Teams. Here’s how retention policies work in SharePoint Online:

1. Create the Retention Policy: Define what content the policy will apply to and whether you want to retain or delete it.
2. Choose Locations: Specify which SharePoint sites, libraries, or lists the retention policy should be applied to.
3. Apply Retention Actions: Set whether the content should be retained for a specific period or deleted after the retention period expires.
4. Enforce and Monitor: Once a policy is applied, the system will automatically manage the retention of content according to the defined rules. Administrators can monitor the effectiveness and compliance of the policies through reports in the Compliance Center.

How to Apply Retention Policies in SharePoint Online?

Creating a Retention Policy in the Microsoft 365 Compliance Center

Follow these steps to create and apply a retention policy in SharePoint Online:

1. Navigate to the Microsoft 365 Compliance Center (compliance.microsoft.com) and log in with your admin credentials.
2. From the left-hand navigation pane, select Information Governance (or Records Management, depending on your interface).
3. Under the Retention section, click + New retention policy to start creating a new policy.
4. Name your policy and provide a description.
5. Choose whether the policy will retain or delete content.
6. For retention, specify how long content should be kept.
7. For deletion, specify how long content will be retained before it’s deleted.
8. Under Locations, choose SharePoint sites to specify which SharePoint sites will be affected.
9. Select Choose Sites to apply the policy to specific sites or libraries.
10. Review your policy settings.
11. Click Create to finalize the policy.

Once created, the retention policy will automatically apply to all specified locations.

Also read: SharePoint On-Premise VS SharePoint Online

Applying Retention Labels to SharePoint Content

To apply retention labels to content, follow these steps:

1. In the Microsoft 365 Compliance Center, navigate to Information Governance > Labels.
2. Click Create a label, then configure retention settings for the label (e.g., retain for 7 years, then delete).
3. Once the label is created, publish it so it can be applied to SharePoint content.
4. You can apply retention labels manually to files in SharePoint libraries or set up auto-labeling policies to apply labels based on content type or metadata.

Managing Retention Policies

After applying retention policies, you can manage and modify them as follows:

• Modify a Policy: In the Microsoft 365 Compliance Center, go to Information Governance> Retention, and click on an existing policy to edit it.
• Delete a Policy: To remove a policy, simply delete it from the Compliance Center. Be cautious as deleting a policy will stop the automatic retention actions, potentially leaving content subject to retention rules unaddressed.
• Monitor Compliance: The Compliance Center provides audit logs and reporting tools to help you monitor how well your retention policies are being followed.

Overcoming Retention Policy Limitations

SharePoint Online retention policies are crucial for maintaining regulatory compliance by automatically retaining, archiving, or deleting content based on preconfigured rules. While these policies are necessary for effective data management, they can present challenges. One of the most notable challenges is that content is permanently deleted once the retention period expires, which can lead to the loss of critical data if not properly managed. This poses a risk during migration, where you may need to ensure that important content is not deleted prematurely due to the expiration of its retention period.

To overcome these limitations and safeguard your data, the SysTools SharePoint Online Migration Tool provides an effective solution. It allows you to migrate content within SharePoint Online, avoiding the pitfalls of retention policies and ensuring better management of data throughout the migration process.

Best Practices for Retention Policies in SharePoint Online

1. Understand Legal and Regulatory Requirements: Make sure you understand the legal requirements for your industry to ensure your retention policies comply with relevant laws.
2. Use Retention Labels for Granularity: While retention policies are good for applying rules across an entire site or organization, retention labels allow for more granular control over specific types of content.
3. Monitor Policy Effectiveness: Regularly review the effectiveness of your retention policies and make adjustments as needed to comply with new regulations or organizational changes.
4. Test Policies on Small Groups: Before applying retention policies across the entire organization, test them on smaller groups to ensure that the content is being handled as expected.

Conclusion

Retention policies are a vital tool for organizations to manage the lifecycle of their content in SharePoint Online. They help enforce compliance with regulatory requirements, reduce storage costs, and ensure sensitive data is properly protected. By using both retention policies and labels, administrators can automate data retention and deletion processes, allowing for more efficient and secure content management.

By following the steps outlined in this guide, you can implement retention policies in SharePoint Online effectively and ensure your organization stays compliant, secure, and efficient in managing its digital content.

Frequently Asked Questions (FAQs) About Retention Policies in SharePoint Online

1. What are the common issues with applying retention policies?

Common issues with retention policies include:

• Incorrect policy application due to improper location selection.
• Confusion between retention policies and retention labels leads to conflicting settings.
• Changes to the content’s metadata or date, cause the retention period to reset unintentionally.
• Misapplication of external sharing rules when content is shared outside the organization.

2. How can I ensure compliance with retention policies in SharePoint Online?

To ensure compliance, regularly audit and review retention policies and labels, monitor the application of these policies, and use reports in the Microsoft 365 Compliance Center to track how policies are applied. Implement regular training for users to understand retention practices and the importance of retention policies within the organization.

3. What is the difference between retention policies and retention labels?

• Retention policies are applied at a broader level across locations like entire SharePoint sites, OneDrive, or Exchange accounts. They can be used to retain or delete content for all items within those locations.
• Retention labels, on the other hand, are applied to individual items (e.g., documents) within SharePoint. A label has specific retention settings that can be applied to a single document or group of documents based on specific criteria.

4. How do retention policies work in SharePoint Online?

Retention policies in SharePoint Online are set through the Microsoft 365 Compliance Center. Once created, the policy defines whether content should be retained or deleted after a specified period. These policies apply automatically to content in SharePoint based on the locations and criteria you specify, and they enforce retention actions (retain, delete, or archive) on the specified content.

5. What is the maximum retention period that I can set?

SharePoint Online allows retention periods ranging from a few days to forever. You can set retention policies for content to be kept for a specific number of days, months, or years. For indefinite retention, you can choose to retain the content without a deletion date.

6. How do I create a retention policy in SharePoint Online?

To create a retention policy:

1. Go to the Microsoft 365 Compliance Center.
2. Select Information Governance or Records Management.
3. Under the Retention section, choose + New Retention Policy.
4. Define the retention rule (e.g., retain for 3 years, then delete).
5. Choose the locations (such as specific SharePoint sites or document libraries).
6. Review and finalize the policy settings.

7. Can I apply retention policies to specific SharePoint sites or libraries?

Yes, you can apply retention policies to specific SharePoint sites, document libraries, or even individual files. When creating a retention policy, you can specify the locations (sites, libraries, or other services) to which the policy will be applied.

8. What happens if I apply a retention policy and the content is edited?

Retention policies in SharePoint Online use the created date or modified date of the document, depending on how the policy is configured. If the content is edited and the retention policy is set to apply from the last modified date, the retention clock resets with the new modification date.

9. Can retention policies delete items from SharePoint Online?

Yes, retention policies can delete items after the specified retention period expires. This is particularly useful for automatically removing outdated documents, ensuring that sensitive or irrelevant data is not retained longer than necessary.

10. How do retention labels work in SharePoint Online?

Retention labels are more granular than retention policies and allow you to apply specific retention settings to individual items. These labels can be manually applied to documents or automatically applied using auto-labeling based on content types or metadata.

11. Can I create a retention label for a specific content type in SharePoint Online?

Yes, you can create retention labels for specific content types such as contracts, invoices, or HR documents. This allows you to tailor retention settings to particular categories of content that have different retention needs, ensuring compliance with specific regulatory requirements.

12. How do I apply retention labels to SharePoint content?

Retention labels can be applied manually to SharePoint documents through the document’s settings or automatically based on predefined criteria like content type, metadata, or keywords. You can also create auto-labeling policies to apply labels to items automatically without user intervention.

13. Can retention policies be applied to external sharing content in SharePoint Online?

Yes, retention policies can be applied to content shared externally via external sharing settings in SharePoint Online. If external sharing is enabled on a document, it is still subject to the retention rules you've set for that document, ensuring that shared content is not kept beyond the retention period.

14. Can I prevent the deletion of specific documents by applying retention policies?

Yes, retention policies can prevent deletion by retaining documents for the required period. When a document is under a retention policy, even if a user attempts to delete it, the retention policy will preserve it until the retention period ends. This ensures compliance and prevents unauthorized or accidental deletion.

15. How can I monitor the effectiveness of my retention policies?

The Microsoft 365 Compliance Center provides monitoring and reporting tools to track the effectiveness of your retention policies. You can access reports that show which documents and content are being retained, deleted, or archived, and how the policies are being applied across SharePoint Online and other services.

16. Can I edit or delete a retention policy once it's been applied?

Yes, you can edit or delete a retention policy at any time from the Microsoft 365 Compliance Center. However, be aware that any changes made to an active policy will impact the content to which it is applied. It's recommended to review the impact of any modifications before making changes.

17. What happens to content if a retention policy is deleted or modified?

If a retention policy is deleted or modified, the existing content under that policy will continue to follow the original policy settings until the retention action (e.g., retention period or deletion) has been completed. After modification or deletion of the policy, new content will follow the updated rules.

18. Can I apply retention policies to metadata or version history?

Retention policies in SharePoint Online primarily apply to documents or items within libraries. However, metadata and version history are typically retained based on the document’s retention settings. Retention labels can help in applying retention settings to specific versions of documents, ensuring compliance for versioned content.