Records management in Microsoft Purview: record labels, file plan and disposition reviews

Retention policies keep or delete whole locations. Records management is for the items that matter one by one: contracts, personnel files, product specifications. In this post I'll walk through declaring records with retention labels in the Microsoft Purview portal, building a file plan, starting retention on business events, and running disposition reviews you can prove afterwards.

How it works#

Records management adds options to the retention label: mark items as a record or a regulatory record, start the period on an event, and start a disposition review at the end. A record is restricted, its activities are logged, and its deletion leaves proof. In SharePoint and OneDrive a record can be locked or unlocked (record versioning); Exchange doesn't support that, so a record email behaves like a locked record.

Reading, copying and moving within the same site or mailbox stay allowed everywhere. The regulatory record is irreversible: once it's applied, nobody, not even a Global Administrator, can remove the label, the period can only be extended, and the label can't be auto-applied or applied to a checked-out SharePoint document.

Prerequisites#

• Roles. The Disposition page needs the Disposition Management role (in the Records Management role group), which a Global Administrator doesn't get by default. Reviewers who preview content also need Content Explorer Content Viewer. See Purview roles and role groups.
• Auditing. Proof of disposition comes from the unified audit log, so make sure auditing is on at least a day before the first disposition action.
• A retention schedule agreed with the records owners: categories, periods, start triggers and approvers.
• Mailbox size. A mailbox needs at least 10 MB of data to support disposition reviews.

Step-by-step#

1. Decide whether you need regulatory records#

Most organizations only need records. If a regulation demands immutability that even admins can't undo, display the hidden option in Security & Compliance PowerShell:

Connect-IPPSSession
Set-RegulatoryComplianceUI -Enabled $true

The setting applies immediately, without a prompt, and is recorded in the audit log. Run it with $false to hide the option again.

2. Build the file plan#

Create record labels from Solutions › Records Management › File plan to get the record options and the file plan descriptors (reference ID, business function, category, authority type and so on). Descriptors don't change behavior, but they make the labels read like your retention schedule, and the file plan can be exported to CSV or imported in bulk. In the wizard choose Retain items forever or for a specific period, set the period and select the option to mark items as a record.

3. Start the period on an event where the schedule says so#

On the Define the period page, When should the period begin? takes the created, last modified or labeled date, or an event type such as an employee leaving. The event type can't be changed after you save the label, and until its event happens the record is kept indefinitely.

4. Add a disposition review#

On Choose what happens after the retention period, select Start a disposition review, then Create stages and assign reviewers: up to five stages, each with up to 10 users or mail-enabled security groups (not Microsoft 365 groups). Optional auto-approval moves an item on after 7–365 days without action (14 by default). Naming reviewers doesn't grant access, so give them the Disposition Management role.

Under Settings › Solution settings › Records Management › Disposition, customize the reviewer emails and select the mail-enabled security group whose members see every review. It can't be changed in the portal later; enable another group with Enable-ComplianceTagStorage -RecordsManagementSecurityGroupEmail.

5. Publish or auto-apply the labels#

Publish labels in a retention label policy so people can apply them in Outlook, SharePoint and OneDrive, or auto-apply record labels (never regulatory ones) based on sensitive information, keywords or searchable properties, or trainable classifiers. Anyone with write access to the mailbox, or in the site's Members group, can apply a published record label. Allow up to seven days for label changes to take effect.

6. Create the event when it happens#

When the employee leaves or the contract expires, go to Solutions › Records Management › Events and select Create. Choose the label's event type, narrow the content with keywords or a query for Exchange and an asset ID such as ComplianceAssetID:EMP-1042 for SharePoint and OneDrive, and enter the event date. Without an asset ID or keywords, every item with a label of that event type starts its clock. Synchronization takes up to seven days, triggered events can't be canceled, and items labeled later need a new event. To automate events from an HR system, use the Microsoft Graph Records Management APIs or New-ComplianceRetentionEvent.

7. Review and dispose#

At the end of the period, reviewers get an email and weekly reminders. On the Disposition page they inspect each item and choose Approve disposal, Relabel, Extend or Add reviewers. Final-stage approval means permanent deletion within 15 days; until then the item stays where it is.

Verify#

• The record is protected. As a test user, try to delete a locked record in SharePoint: it should be blocked.
• Labeling is audited. In audit search, Changed retention label for a file covers SharePoint and OneDrive and Labeled message as a record covers mail. See searching the audit log.
• The event will hit the right items. Before you create it, run an eDiscovery search for ComplianceAssetID:<value> or the retention label to see what it covers.
• Disposal is provable. The Disposition tab lists items deleted after review and records deleted automatically (type Records Disposed); filter by deletion date and export to CSV. The audit log adds Deleted file marked as a record and every review action.

Tips and gotchas#

• Retention policies can't do disposition review. Keep baselines in retention policies (targeted with adaptive scopes if needed) and records in labels; the principles of retention decide when both apply.
• List attachments. A standard label on a SharePoint list item doesn't protect its attached document; a record or regulatory record label does.
• Storage. Edits to unlocked records keep copies in the Preservation Hold library; see why that library grows. For mail, compare with retention policies and litigation hold in Exchange Online.
• Migrated records. To prove a migrated file is unchanged, compare a base64-encoded QuickXorHash of the original with its vti_writevalidationtoken property; size and hash change on upload.
• Something not applying? Check the policy status messages in the retention, records and audit errors quick reference.

References#

• Learn about records management (Microsoft Learn)
• Disposition of content (Microsoft Learn)
• Start retention when an event occurs (Microsoft Learn)