Static scopes make you list mailboxes, sites and OneDrive URLs by hand and keep that list current. Adaptive scopes replace the list with a query on attributes such as department, country or site template, which Microsoft Purview runs again every day. In this post I'll explain where adaptive scopes work (and what to use for DLP), how to build user, group and site queries, how to validate them before the five-day wait, and how to fix a scope that stays empty.
How it works#
An adaptive scope is a reusable query object. Its type decides what it can target and which query language it uses:
| Scope type | Targets | Advanced query | Attributes in the simple builder |
|---|---|---|---|
| Users | Exchange mailboxes, OneDrive accounts, Teams chats, Viva Engage user messages, Copilot and AI app interactions | OPATH | Name and address fields, job title, department, office, country or region, email addresses, alias, CustomAttribute1–15, ExtensionCustomAttribute1–5 |
| SharePoint sites | Sites and OneDrive accounts (retention); sites (auto-labeling) | KQL | Site URL, site name, site template, RefinableString00–99 |
| Microsoft 365 Groups | Group mailboxes and sites, Teams channel messages, Viva Engage community messages | OPATH | Name, display name, description, email addresses, alias, custom attributes |
User and group attributes are Exchange filterable recipient properties that map to Microsoft Entra attributes; site properties are SharePoint managed properties. Because the query runs daily, new hires and new sites join without anyone editing the policy, and an adaptive policy has no item limit.
Note: Microsoft's adaptive scopes page lists policies for retention, communication compliance and auto-labeling; the Get-AdaptiveScopeMembers reference also mentions Insider Risk Management. DLP policies aren't listed. For DLP, scope locations by users and groups or administrative units, or tighten rules for risky users with Adaptive Protection. Re-check the page, because supported solutions change.
Static or adaptive?#
For retention, each policy uses one or the other. Static is simplest when a policy covers all mailboxes or all sites. Adaptive is better when membership changes or the list is long, and it's the only way to target or exclude inactive mailboxes deliberately. Know the trade-offs:
- Skype for Business and Exchange public folders need static scopes.
- Adaptive scopes don't currently support Preservation Lock.
- An adaptive policy counts as scoped under the principles of retention, so its delete action beats an org-wide policy's delete action (retention still wins over deletion).
- One adaptive policy can cover Teams and Viva Engage together; without adaptive scopes each location needs its own policy.
Prerequisites#
- A role group with the Scope Manager role, such as Compliance Administrator, Compliance Data Administrator, Organization Management or Records Management.
- Reliable directory data. Agree with the Entra ID and Exchange admins which attribute holds the value and exactly how it's written.
- For custom site properties, extra SharePoint search configuration so the value lands in a
RefinableStringmanaged property. - Licenses that cover adaptive scopes for the targeted users: unlicensed users can match a query but don't get the policy.
Step-by-step#
1. Create the scope#
In the Microsoft Purview portal go to Settings › Roles and scopes › Adaptive scopes and select Create scope. If your account is restricted to administrative units, pick one; otherwise keep Full directory. Site scopes aren't available when you select an administrative unit. Choose the type and add conditions with Add attribute (or Add property for sites). The simple builder offers is equal to, is not equal to, starts with and not starts with.
2. Use the advanced query builder for anything subtle#
For users and groups it accepts OPATH with and, or, not, eq, ne, lt, gt, like and notlike; for sites it takes KQL:
Users: Finance in Germany, excluding inactive mailboxes
(Department -eq "Finance") -and (CountryOrRegion -eq "Germany") -and (IsInactiveMailbox -eq "False")
Users: inactive mailboxes only
(IsInactiveMailbox -eq "True")
Sites: modern communication sites only
SiteTemplate=SITEPAGEPUBLISHINGSite scopes include every site type, so filter on SiteTemplate: GROUP (group-connected), TEAMCHANNEL (private channel sites), STS (classic team sites) or SPSPERS (OneDrive).
3. Validate the query before you rely on it#
The portal doesn't check values as you type them, so run the same filter in Exchange Online PowerShell:
Connect-ExchangeOnline
# User scope; Get-Recipient also returns MailUser objects (on-premises mailboxes in hybrid)
Get-Recipient -RecipientTypeDetails UserMailbox,MailUser,SharedMailbox,RoomMailbox,EquipmentMailbox `
-Filter {(Department -eq "Finance") -and (CountryOrRegion -eq "Germany")} -ResultSize Unlimited |
Measure-Object
# Microsoft 365 Group scope
Get-Mailbox -RecipientTypeDetails GroupMailbox -Filter {CustomAttribute15 -eq "Marketing"} -ResultSize UnlimitedEmailAddresses values usually need the smtp: prefix. For site scopes, open https://<tenant>.sharepoint.com/search as a SharePoint admin and run the KQL query.
4. Wait, then check membership#
Queries run daily and can take up to five days to populate, and later query changes take as long, so create scopes a few days before you need them. Open the scope and select Scope details: the State column shows Added for current members and Removed for members that no longer match. For large scopes use PowerShell:
Connect-IPPSSession
# Metadata only: total member count
(Get-AdaptiveScopeMembers -Identity "DE Finance users" -PageResultSize 0)[0].TotalMemberCount
# Current members; the first object returned is metadata
Get-AdaptiveScopeMembers -Identity "DE Finance users" -State Added | Select-Object -Skip 1Each call returns up to 10,000 members, and the metadata carries a watermark for -PageCookie to fetch the next page.
5. Attach the scope to a policy#
When you create the retention policy, choose adaptive instead of static, add one or more scopes, and turn on the locations that scope type supports. Allow up to seven days for the policy to apply.
Verify#
- Scope details or
Get-AdaptiveScopeMemberslist the members you expect. Small differences from PowerShell counts are normal (scope details include arbitration mailboxes). - Policy lookup in Data Lifecycle Management or Records Management shows the policy for a sample member (exact email address or site URL; no wildcards).
Get-RetentionCompliancePolicy -Identity "<policy>" -DistributionDetail(Get-AppRetentionCompliancePolicyfor Teams chats, Viva Engage and Copilot locations) showsDistributionStatus : Success; otherwise see policy distribution errors.
Tips and gotchas: when a scope stays empty#
- It's too new. Wait five days before changing the query.
- The value doesn't match. A department spelled differently in HR and Entra ID, or a value with a typo, silently matches nobody. Compare with the PowerShell filter.
- Administrative units. A scope restricted to an administrative unit only finds that unit's members, even if the attribute matches elsewhere.
- Hybrid and unlicensed accounts. Validate with
Get-RecipientorGet-User, becauseGet-Mailboxdoesn't return MailUser objects. Synced accounts without a mailbox (Get-User -RecipientTypeDetails User) inflate counts but never get the policy. - Sites missing. Site scopes depend on search: test the KQL in SharePoint search and confirm custom properties are mapped. Legacy Records Center sites aren't supported.
- Query limits. 200 characters per value, 10 attributes per group, 10 groups, no nested groups, 10,000 characters per advanced query.
- Right members, wrong outcome. Overlapping policies follow the principles of retention; see retention policies not applying and, for mailboxes, retention policies vs litigation hold.
