4.3MS-102Advanced
Est: ~15 mins•Verified: 2026-08
Purview Data Lifecycle: Retention & eDiscovery
Implement automated retention policies, retention labels, regulatory records, inactive mailboxes, and legal holds with Microsoft Purview eDiscovery.
Tags:#Purview#Retention#eDiscovery#Legal Hold#Compliance#MS-102
01
Overview
Microsoft Purview Data Lifecycle Management and eDiscovery ensure that corporate organizations comply with statutory retention regulations, legal discovery requests, and data disposal mandates:
- Retention Policies: Broad, container-level rules applied across entire workloads (Exchange mailboxes, SharePoint sites, Teams chats). They dictate whether data must be Retained for X years, Deleted after X years, or Retained then Deleted.
- Retention Labels: Item-level tags applied to specific documents or emails that carry explicit retention schedules, disposition reviews, or immutability locks (Regulatory Records).
- Preservation Hold Library: Hidden SharePoint/OneDrive storage where modified or deleted versions are preserved invisibly to the user during retention periods.
- eDiscovery (Standard / Premium): Search, identify, place legal holds, and export electronic records for internal investigations and litigation.
---
02
When to Use: Retention Architecture
| Mechanism | Target Scope | User Visibility | Deletion Protection |
|---|---|---|---|
| Retention Policy | Entire workload (All mailboxes / All sites) | Silent / Invisible | Users can delete files; copy is moved to hidden Preservation Hold Library. |
| Retention Label | Specific individual documents / emails | Visible in app metadata | Can be locked as a Record to prevent tampering or modification. |
| eDiscovery Legal Hold | Case-specific custodian mailboxes & sites | Silent / Immutable | Overrides all deletion rules until legal case is resolved. |
---
03
Prerequisites
Licensing:
- Microsoft 365 E3 for basic retention policies and eDiscovery (Standard).
- Microsoft 365 E5 for Regulatory Records, machine learning trainable classifiers, and eDiscovery (Premium).
Roles:
- Compliance Administrator or eDiscovery Manager.
---
04
Portal Path
TEXT
Microsoft Purview Portal (https://purview.microsoft.com)
├── Data lifecycle management
│ └── Microsoft 365
│ ├── Retention policies (Create organization-wide retention rules)
│ └── Retention labels (Create item-level labels & publish)
└── eDiscovery
└── Standard (Create case, place holds, run searches, export PSTs)---
05
Step-by-Step Implementation
Step 1: Create a 7-Year Financial Retention Policy
- In Purview Portal > Data lifecycle management > Microsoft 365 > Retention policies > Click New retention policy.
- Name:
Retention-Finance-7Years. - Policy scope:
Static(or Adaptive scope). - Locations: Select
Exchange mailboxes,SharePoint classic and communication sites,OneDrive accounts. - Decide if you want to retain content, delete it, or both:
- Select Retain items for a specific period:
7 years. - Start the retention period based on:
When items were created. - At the end of the retention period:
Delete items automatically.
- Submit policy.
Step 2: Create an eDiscovery Case and Place a Legal Hold
- Navigate to eDiscovery > Standard > Click Create a case.
- Case name:
Legal-Case-2026-PatentLitigation. - Open the case > Navigate to Holds tab > Click Create.
- Name hold:
Custodian-Hold-Executives. - Under Locations, choose mailboxes and OneDrive accounts of the custodians involved in litigation.
- Submit hold. (Even if the user purges emails or deletes their inbox, all items are preserved immutably).
---
06
PowerShell Automation
Connect to Security & Compliance PowerShell:
PowerShell
Connect-IPPSSession -UserPrincipalName admin@contoso.com
# List all active retention policies
Get-RetentionCompliancePolicy | Select-Object Name, Mode, Enabled, Workload
# Query active eDiscovery legal holds
Get-CaseHoldPolicy | Select-Object Name, CaseId, ExchangeLocation---
07
Microsoft Graph Automation
Create an eDiscovery Case via Graph API:
PowerShell
Connect-MgGraph -Scopes "eDiscovery.ReadWrite.All"
$Case = @{
displayName = "Internal Audit Case 2026"
description = "HR compliance investigation"
}
New-MgSecurityCaseEdiscoveryCase -BodyParameter $Case---
08
Verification Checklist
VERIFICATION CHECKLIST
0/4 (0%)
Retention policy status shows Success across all workloads.
Deleting a file from a protected SharePoint site moves it to the hidden Preservation Hold Library.
eDiscovery search query for custodian keywords returns matching email and chat records.
Legal hold prevents permanent purge from the Exchange Recoverable Items folder.
09
Diagnostic Logs & Channels
| Resource | Path | Purpose |
|---|---|---|
| Preservation Hold Library | https:// | Hidden storage location where copies of deleted/modified files are preserved. |
| Recoverable Items Folder | Purges / DiscoveryHolds subfolder in Exchange | Preserves deleted emails until the retention timer or legal hold is released. |
---
10
Troubleshooting Matrix
| Error Code / Symptom | Root Cause | Exact Resolution |
|---|---|---|
| User mailbox storage exhausted | Retained emails accumulating in the Recoverable Items quota (default 100 GB). | Enable Auto-expanding archiving in Exchange to provide up to 1.5 TB archive storage. |
| Cannot empty recycle bin in SharePoint | Site is subject to an active retention policy or eDiscovery legal hold. | This is expected behavior; compliance policies prevent manual permanent purges. |
---
11
Production Best Practices
Production Best Practice
Principles of Retention Precedence:
When multiple retention policies conflict, Microsoft Purview evaluates them using the official Principles of Retention:
- Retention wins over deletion.
- Longest retention period wins.
- Explicit (Labels) wins over implicit (Container Policies).
- Shortest deletion period wins.
---
12
MS-102 Exam Notes
Exam Blueprint & High-Yield Traps
High-Frequency Exam Objectives & Traps:
- Regulatory Records: Once an item is declared as a Regulatory Record, the label can NEVER be removed or changed, and the file cannot be edited or deleted by ANY admin.
- Inactive Mailboxes: An inactive mailbox preserves email for former employees indefinitely at zero license cost by placing a retention policy before deleting the user account.
- Teams Chat Retention: Teams chats and channel messages require their own dedicated retention policy; they are not covered by standard Exchange/SharePoint policies.
---
13