Purview Retention, Hold and Audit Errors: Quick Reference

Retention problems rarely arrive as a numbered error. You get a status line in a policy's details pane, a mailbox property, a system message in Teams or an audit search that returns nothing. This quick reference collects the retention, records, hold and audit messages and statuses Microsoft documents, with the meaning, usual cause and first check for each.

Codes in this quick reference

We're still processing your policy (PolicySyncTimeout): policy sync didn't finish in timePurview portal (policy details pane)
We couldn't find this location (FailedToOpenContainer): a location in the policy no longer existsPurview portal (policy details pane)
The location is ambiguous (MultipleInactiveRecipientsError): more than one object matches a locationPurview portal (policy details pane)
The site is locked (SiteInReadOnlyOrNotAccessible): site locked by an admin or an automated processPurview portal (policy details pane)
The location is out of storage (SiteOutOfQuota): not enough storage to apply the policyPurview portal (policy details pane)
We can't process your policy (ActiveDirectorySyncError): policy didn't sync with Microsoft Entra IDPurview portal (policy details pane)
Something went wrong (PolicyNotifyError): unspecified error in the policy notification pipelinePurview portal (policy details pane)
We ran into a problem (InternalError): unspecified policy sync and distribution errorPurview portal (policy details pane)

+ 49 more codes in the tables below.

Browse the Purview error library

At a glance: how this guide is organized · 2 steps · 5 key settings and tools

How to read these codes#

Figure 1 · Decision tree Where to read a retention, hold or audit problem first. Start from where the problem shows up. Policy status is read in the details pane and with -DistributionDetail; holds and audit settings in Exchange Online PowerShell.

Policy status shows in the Status section of a retention or label policy under Data Lifecycle Management or Records Management. Select the policy name, not its checkbox, or the details pane won't open.
Distribution details come from Security & Compliance PowerShell. Act on DistributionResults only when DistributionStatus reports errors; warnings can be ignored. Microsoft doesn't support policies that keep errors, so fix every one.
Holds are mailbox and organization properties in Exchange Online PowerShell.
Audit settings must be read in Exchange Online PowerShell.

PowerShell

Connect-IPPSSession
Get-RetentionCompliancePolicy -Identity "<policy>" -DistributionDetail | Format-List DistributionStatus
Get-RetentionCompliancePolicy -Identity "<policy>" -DistributionDetail |
  Select-Object -ExpandProperty DistributionResults
# Teams private channels, Viva Engage, and the newer Teams chats and Copilot locations
Get-AppRetentionCompliancePolicy -Identity "<policy>" -DistributionDetail |
  Select-Object -ExpandProperty DistributionResults

Retention and label policy statuses#

These appear in a policy's Status section. Retry means selecting Retry in the details pane or running Set-RetentionCompliancePolicy -Identity "<policy>" -RetryDistribution.

Code or message	Meaning	Usual cause	First check
We're still processing your policy `PolicySyncTimeout`	Policy sync timed out	Service-side sync delay	Retry
We couldn't find this location `FailedToOpenContainer`	A location in the policy doesn't exist	Site, mailbox or group deleted after it was added	Remove the location (required in the next update), then retry
The location is ambiguous `MultipleInactiveRecipientsError`	More than one object matches a location	Duplicate matches for one location	Remove the duplicate, then retry
The site is locked `SiteInReadOnlyOrNotAccessible`	The policy can't update the site	Admin lock, or a temporary lock during an automated process	Unlock the site, then retry
The location is out of storage `SiteOutOfQuota`	Not enough storage to apply the policy	Site at its quota	Raise the quota or delete items, then retry
We can't process your policy `ActiveDirectorySyncError`	Policy didn't sync with Microsoft Entra ID	Service-side sync failure	Retry
Something went wrong `PolicyNotifyError`	Error in the notification pipeline	Unspecified, service-side	Retry
We ran into a problem `InternalError`	Unspecified sync or distribution error	Service-side	Retry; open a support case if it persists
Settings not found	The retention policy has no rules	Policy saved without a rule	Add one with `New-RetentionComplianceRule` or `New-AppRetentionComplianceRule`
You can't apply a hold here `RecipientTypeNotAllowed`	A location was rejected when added (portal, or PowerShell)	The policy doesn't support that mailbox type	Remove that location and save again
`PendingDeletion`	Policy deletion didn't complete	Unspecified error while deleting	`Remove-RetentionCompliancePolicy -Identity "<policy>" -ForceDeletion`
`DistributionStatus : Pending`	Sync and distribution still running	A recent create or edit	Wait until it's no longer Pending before the next change; batch location changes into one command

Adaptive scopes#

Code or message	Meaning	Usual cause	First check
State: Added or Removed	Current member, or former member that no longer matches	Daily query run	Scope details, or `Get-AdaptiveScopeMembers -State Added`
Scope empty or members missing	Query hasn't populated, or matches nothing	New or edited scope (up to five days), a value typo, or an administrative unit limit	Validate with `Get-Recipient -Filter` or SharePoint search

Teams, SharePoint and OneDrive#

Code or message	Meaning	Usual cause	First check
We've deleted older messages due to your org's retention policy	A retention policy deleted older chat messages	Your policy, or the policy of an external participant's organization	Policy lookup; retained copies can still be in eDiscovery
This message has been deleted because of a Retention Policy	A channel post was deleted by retention	The post expired; replies still in their period remain	As above; the text can't be customized
File not found	A file shared in a chat or channel no longer exists	The file had its own SharePoint or OneDrive retention	Check the policies on the file's site or OneDrive
Expired messages still visible	Deletion hasn't reached the app yet	Timer jobs and caching: up to seven days after expiry	Wait; verify with eDiscovery, not the app
Error deleting a library, list or site	Deletion blocked	The container is subject to retention	Expected; change retention only if the requirement allows
Error deleting a labeled file	Deletion blocked; the file stays in place	Deleting content labeled for retention is off (separate settings for SharePoint and OneDrive)	Settings › Solution settings › Records Management › Retention Labels
Content still in the Preservation Hold library	Cleanup hasn't removed it yet	Weekly timer job with a 30-day minimum (up to 37 days), then up to 93 days in the recycle bins	Wait; check for other policies or holds
Retention not applied to a site	The site is skipped	The site isn't indexed	Make sure search crawls the site

Records, labels and disposition#

Records and labels#

Code or message	Meaning	Usual cause	First check
Regulatory record option missing	Hidden by default	Never enabled	`Set-RegulatoryComplianceUI -Enabled $true` in Security & Compliance PowerShell
Regulatory record label can't be removed	By design	Nobody, not even a Global Administrator, can remove it; its period can only be extended	Use it only where regulation demands it
Regulatory record label can't be auto-applied or applied	Not supported	Auto-apply policies; documents checked out in SharePoint	Publish it in a label policy; check the file in
Record can't be edited or deleted	Record restrictions	Locked record; Exchange records always behave as locked	Unlock it in SharePoint or OneDrive to edit; deletion stays blocked
Record can't be moved to another site, OneDrive or mailbox	Move across containers blocked	Record that is or was unlocked, or a regulatory record	Copy it, or move it within the same container
Record label can't be changed or removed	Blocked for users	Only a container admin can, and only while the record is locked	Ask the site admin; regulatory labels never change
Record properties can't be edited	Tenant setting	Editing record properties is turned off in Records Management settings	Settings › Solution settings › Records Management › Retention Labels
Auto-apply policy skipped labeled items	Existing label kept	Auto-apply never replaces an existing retention label; with several matching policies you can't control which label wins	Check the current label; allow up to seven days

Disposition and events#

Code or message	Meaning	Usual cause	First check
Disposition page not available	Missing role	Global Administrators don't get Disposition Management by default	Records Management role group, or a custom group with Disposition Management
Reviewer can't preview or act	Missing permissions	No Content Explorer Content Viewer role (preview); reviewers added during a review get no roles	Assign the roles
Only your own reviews are listed	Default view	No records manager security group selected	Settings › Solution settings › Records Management › Disposition; change it later with `Enable-ComplianceTagStorage`
Mailbox items never reach disposition review	Not supported	Mailbox has less than 10 MB of data	Expected
Approved, but the item still exists	Permanent deletion pending	Deletion happens within 15 days of final approval	Wait, then check the disposed items
Records Disposed	A record was deleted automatically at the end of its period	Record label without disposition review	Export the view to CSV as proof; the view depends on auditing being on
Event created, but retention didn't start	Event not applied to some items	Sync takes up to seven days; asset ID or keywords don't match; items labeled after the event	Search for `ComplianceAssetID:<value>`; create a new event for later items (events can't be canceled)

Mailbox holds#

Read these in Exchange Online PowerShell with Get-Mailbox <user> | Format-List LitigationHoldEnabled, InPlaceHolds, *HoldApplied* and Get-OrganizationConfig | Select-Object -ExpandProperty InPlaceHolds. Look a GUID up without its prefix and suffix.

Code or message	Meaning	Usual cause	First check
`LitigationHoldEnabled : True`	Mailbox on Litigation Hold	Legal preservation of a person	Confirm with legal before removing; a delay hold follows
`UniH<GUID>`	eDiscovery hold	Hold in an eDiscovery case	`Get-CaseHoldPolicy <GUID>`, then `Get-ComplianceCase` with its `CaseId`
`mbx<GUID>` or `skp<GUID>` on the mailbox	Retention policy that targets this mailbox (skp: Skype for Business)	Policy with specific locations	`Get-RetentionCompliancePolicy <GUID> -DistributionDetail`
`mbx<GUID>` or `grp<GUID>` on the organization	Organization-wide policy: mbx for mailboxes, public folders and Teams chats; grp for groups and Teams channel messages	Policy set to all locations	Same lookup
`-mbx<GUID>`	Mailbox excluded from an organization-wide policy	Exclusion	Expected
Suffix `:1`, `:2` or `:3`	Action: delete (or a label policy), retain, retain then delete	Policy settings; label policies always show :1	Check each published label
`InPlaceHolds` empty	No policy stamped on the mailbox	Organization-wide policies, or newer locations (Teams chats, private channels, Viva Engage, Copilot) that don't stamp	`Get-OrganizationConfig` and Policy lookup
`ComplianceTagHoldApplied : True`	Mailbox treated as on hold; mailbox and archive can't be disabled	A retaining label was applied to an item or folder; the flag doesn't reset itself	`Set-Mailbox <user> -RemoveComplianceTagHoldApplied -ProvideConsent` when no longer needed
`DelayHoldApplied : True`	30-day delay hold on mail after a hold was removed	Any hold removed; it stays past 30 days while the account is disabled	Wait, or `Set-Mailbox <user> -RemoveDelayHoldApplied` (Legal Hold role)
`DelayReleaseHoldApplied : True`	Same, for Teams, Forms and Viva Engage data	Any hold removed	`-RemoveDelayReleaseHoldApplied`; add `-InactiveMailbox` for inactive mailboxes

Audit log search#

Code or message	Meaning	Usual cause	First check
Start recording user and admin activity	Auditing is off	Not on by default for Business Basic, Standard and Premium or unmanaged trial tenants; or turned off	Select the banner; allow up to 60 minutes, and hours before events appear
`UnifiedAuditLogIngestionEnabled : False` (Exchange Online PowerShell)	Auditing off; searches, the Management Activity API and Microsoft Sentinel get no data	As above	`Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true` (Audit Logs role)
The same value in Security & Compliance PowerShell	Not meaningful there	The property always reads False in that session	Check in Exchange Online PowerShell
Error for a date range over 180 days	Range too long	More than 180 days selected	Shorten it; for a full 180 days, use the current time for the start. A range can't start before auditing was turned on
No results for an operation	Name not matched	Operation name typed incorrectly	Copy names from Microsoft's audit activities list
Can't start a search; jobs stay Queued or In Progress	Job limits	10 parallel jobs per user, one unfiltered; broad searches can take up to 48 hours	Wait for or delete a job; narrow dates, users and activities
Export stops at 50,000 rows	Export limit	50,000 rows for Audit (Standard), 1,000,000 for Audit (Premium)	Split the search, or use `Search-UnifiedAuditLog` or the Management Activity API
Recent activity missing	Not ingested yet	Typically 60–90 minutes for core services; no guaranteed time	Search again later
Older records missing	Outside retention	180 days for Audit (Standard) (90 for records before 17 October 2023); one year for E5 users' Entra ID, Exchange and SharePoint activity	Audit retention policies, or a SIEM for longer needs
Restricted admin misses events	Search scoped by administrative units	System activity and some operations need an unrestricted admin	Use an unrestricted admin account

How to verify a fix#

Policies: rerun the distribution commands above. DistributionStatus should read Success and the details pane should show no error; see policy distribution errors for the full workflow.
Coverage: Policy lookup for a test user, group or site lists exactly the policies you expect.
Holds: Get-Mailbox shows only the holds you intend. For history, run Export-MailboxDiagnosticLogs <user> -ComponentName HoldTracking and convert the MailboxLog from JSON.
Retention and records: confirm with an eDiscovery search rather than what users see in Teams or SharePoint; see retention not applying and records management in Purview.
Audit: perform a test action and find it in a new search a couple of hours later. Search-UnifiedAuditLog -Operations Set-AdminAuditLogConfig shows who last changed the auditing status; more in searching the audit log.

Purview retention, records and audit errors: policy statuses, holds and audit search

How to read these codes#

Retention and label policy statuses#

Adaptive scopes#

Teams, SharePoint and OneDrive#

Records, labels and disposition#

Records and labels#

Disposition and events#

Mailbox holds#

Audit log search#

How to verify a fix#

References#

Omer Eltayeb

Purview retention, records and audit errors: policy statuses, holds and audit search

How to read these codes#

Retention and label policy statuses#

Adaptive scopes#

Teams, SharePoint and OneDrive#

Records, labels and disposition#

Records and labels#

Disposition and events#

Mailbox holds#

Audit log search#

How to verify a fix#

References#

Omer Eltayeb

More Purview articles

Purview retention policies not applying to Teams, SharePoint or OneDrive: what to check

Adaptive scopes in Microsoft Purview: target retention policies with OPATH and KQL queries

The Preservation Hold library in SharePoint and OneDrive: why storage grows and what to do