How To Set Up Microsoft 365 Retention Policies For Small Business Australia

Summary

This guide helps you troubleshoot and resolve: How To Set Up Microsoft 365 Retention Policies For Small Business Australia. Follow the steps below to fix the issue.

Common Causes

Microsoft 365 retention policies help Australian small businesses manage how long email, documents, and other business data are kept before being permanently deleted. For organisations subject to regulatory requirements or internal governance standards, these policies provide a consistent way to preserve information across Exchange Online mailboxes, SharePoint sites, and OneDrive accounts. This guide explains how retention policies work, the difference between retention and deletion, and the administrative considerations you should review before applying them across your organisation.

Understanding Microsoft 365 Retention Policies

A retention policy determines how long content is kept and what happens when that period expires. Unlike manual archiving or personal Outlook rules, organisation-wide retention policies apply automatically to mailboxes, sites, and OneDrive accounts based on the locations you select.

When retention is enabled, items are kept for the specified period even if a user deletes them. Deleted items are moved to a hidden folder and remain recoverable until the retention period ends. Once the period expires, items can be permanently deleted depending on the action you configure.

Retention vs Permanent Deletion

• Retain only: Items are kept for the retention period and then left in place indefinitely.
• Retain and then delete: Items are kept for the retention period, then permanently deleted.
• Delete only: Items are permanently deleted after a specified age, regardless of whether they were modified or accessed during that time.

Locations Supported by Retention Policies

You can apply retention policies to the following Microsoft 365 locations:

• Exchange email (mailboxes, including shared and resource mailboxes)
• SharePoint sites
• OneDrive accounts
• Microsoft 365 Groups
• Teams chat and channel messages

For most small businesses, the primary focus is Exchange mailboxes, OneDrive, and SharePoint. This ensures business email and file data are governed consistently across the platforms your staff use daily.

Planning Your Retention Policy

Before creating a policy in the Microsoft Purview compliance portal, consider the following:

• Retention period: How long must data be kept? Common periods for small businesses range from 1 to 7 years, depending on industry requirements.
• Scope: Will the policy apply to all users and sites, or only specific departments or mailboxes?
• End-of-period action: Should data be retained indefinitely after the period, or permanently deleted?
• Legal holds: If a mailbox or site is subject to litigation or investigation, legal hold takes precedence over retention policies.

Creating a Retention Policy in Microsoft Purview

1. Sign in to the Microsoft Purview compliance portal at https://compliance.microsoft.com using an account with global administrator or compliance administrator permissions.
2. In the left navigation pane, select Data lifecycle management > Microsoft 365 > Retention policies.
3. Click + New policy or New retention policy.
4. Enter a name and description for the policy, such as Small Business Email Retention - 7 Years, then click Next.
5. Choose the locations to include:
   • Exchange email
   • SharePoint sites
   • OneDrive accounts
   Toggle each location to On. You can choose to apply the policy to all locations or select specific users and sites.
6. Click Next.
7. Decide whether to retain content, delete content, or both. Select Retain items for a specific period and enter the number of days, months, or years.
8. Choose what happens after the retention period ends:
   • Do nothing: Items remain in place.
   • Delete items automatically: Items are permanently deleted.
9. Click Next, review your settings, and click Submit or Create.

After creation, the policy can take up to 24 hours (and sometimes longer for large tenants) to apply to all selected locations.

Viewing and Managing Retention Policies

1. Go to Data lifecycle management > Microsoft 365 > Retention policies in the Microsoft Purview compliance portal.
2. Select a policy from the list to view its details, including locations, retention period, and status.
3. To edit a policy, select it and click Edit policy. You can adjust locations, retention periods, or end-of-period actions.
4. To remove a policy, select it and click Delete policy. Be aware that deleting a policy may trigger permanent deletion of items that were retained solely by that policy.

Outlook Archiving and Retention

Outlook archiving moves older email from your primary mailbox to an archive mailbox, reducing clutter while keeping messages accessible. Retention policies operate independently of Outlook archive settings but can work alongside them. For example, a retention policy can keep email in a user's mailbox for seven years while the user uses Outlook's archive feature to move older messages to an online archive for easier organisation.

If you are using Outlook desktop, you can access archive features through:

• File > Mailbox Settings > Archive
• The Archive button on the Home ribbon in Outlook

For related Outlook guidance, see Setting Up an Email Account in Outlook (POP/IMAP/Exchange), Managing Email Signatures in Outlook, and Backing Up and Restoring Outlook Data Files (.pst/.ost).

Recovery and Deletion Windows

When a user deletes an email in Outlook, it typically moves to the Deleted Items folder and then to the Recoverable Items folder if purged. Retention policies extend this window by preserving items in a hidden folder for the duration of the policy. Administrators can use content search in the Microsoft Purview compliance portal to locate and export retained items, even after a user has deleted them from their mailbox.

Once the retention period expires and the policy is set to delete, items are permanently removed and cannot be recovered through standard Microsoft 365 tools.

Administrative Considerations for Small Business

• Ensure at least two administrators have access to the Microsoft Purview compliance portal in case one account is locked or compromised.
• Document your retention policy names, periods, and locations so the configuration is clear to new IT staff or external support providers.
• Review policies annually to ensure they still meet your organisation's compliance and operational needs.
• Communicate retention expectations to staff so they understand that deleted email may still be retained for compliance purposes.

If you need assistance planning or applying retention policies for your organisation, Open a Ticket with our support team.

Still Having Issues?