What retention policies, retention labels, and litigation holds actually do, how they interact, what a mailbox on hold looks like from the inside, and the commands to check and manage all of it.
Retention in Microsoft 365 is one of the most misunderstood areas in MSP work, largely because three different mechanisms (retention policies, retention labels, and litigation hold) produce similar outcomes through different means, and the Purview compliance portal presents them as though they are interchangeable. They are not. Getting the distinction wrong leads to over-retention, unexpected deletions, or failed legal holds, all of which have real consequences.
A retention policy is applied at the container level: a mailbox, a SharePoint site, a Teams channel. It tells M365 to retain content for a period, delete content after a period, or both. The policy is silent to the end user; they cannot see or remove it. Content subject to a retain-and-delete policy is kept in the Recoverable Items folder (for Exchange) or the Preservation Hold Library (for SharePoint) even after the user deletes it, until the retention period expires. Then it is deleted automatically.
A retention label is applied at the item level: a specific email, a specific document. It can be applied manually by a user, automatically by a trainable classifier or keyword condition, or published for users to apply themselves. Labels take precedence over policies at the item level. A document labelled with a 7-year retention label inside a SharePoint site with a 3-year deletion policy will be kept for 7 years.
Litigation hold is a legacy Exchange mechanism that freezes all content in a mailbox indefinitely, regardless of any other policy. It was the predecessor to eDiscovery holds and is still widely used. A mailbox on litigation hold ignores deletion actions entirely; nothing leaves Recoverable Items until the hold is removed. It has no expiry by default, which is why many tenants have holds placed years ago that no one remembers.
When multiple policies or holds apply to the same content, the principle is: the most restrictive retention wins. If a retention policy says delete after 3 years and a litigation hold says keep forever, the content is kept forever. If two retention policies give different periods, the longer one wins. Deletion only happens when no policy or hold requires the content to be kept.
This is the most common practical question: a user's mailbox is unexpectedly large, or you need to confirm a mailbox is properly preserved before offboarding someone. Check all holds at once:
Get-Mailbox user@contoso.com | Select-Object LitigationHoldEnabled, LitigationHoldDate, LitigationHoldOwner, LitigationHoldDuration, InPlaceHolds, RetentionPolicy, RetentionHoldEnabled
The fields to read:
| Field | Meaning |
|---|---|
LitigationHoldEnabled | True means the entire mailbox is on litigation hold. All content is preserved indefinitely. |
LitigationHoldDuration | If set, the hold expires after this many days. Unlimited means no expiry. |
InPlaceHolds | Lists GUIDs of any eDiscovery or Compliance holds applied via the Purview portal. A GUID starting with UniH indicates a Purview retention policy. |
RetentionPolicy | The name of any MRM (Messaging Records Management) retention policy. This is a separate, older system from Purview retention policies. |
The GUIDs in InPlaceHolds are not human-readable on their own. To see what each one represents:
Get-RetentionCompliancePolicy | Where-Object {$_.Guid -in (Get-Mailbox user@contoso.com).InPlaceHolds} |
Select-Object Name, Enabled, Mode, RetentionAction, RetentionDuration
When a mailbox is on hold, deleted items accumulate in Recoverable Items rather than being purged. A mailbox with years of held content can hit the Recoverable Items quota (100GB by default for held mailboxes), which blocks further deletions and can cause mail delivery failures. Check the current size:
Get-MailboxFolderStatistics user@contoso.com -FolderScope RecoverableItems | Select-Object Name, ItemsInFolder, FolderSize
If the Recoverable Items folder is approaching its limit, the options are: remove the hold if it is no longer needed, increase the quota (requires an Exchange Online Plan 2 or EOP add-on licence), or perform a managed folder assistant run to process and purge content that has exceeded its retention period:
Start-ManagedFolderAssistant -Identity user@contoso.com
Place a litigation hold before offboarding any user involved in a dispute, HR matter, or regulatory investigation. Set a duration if the legal team has given a specific timeframe; leave it unlimited (the default) if uncertain:
Place hold with a note for audit purposes
Set-Mailbox user@contoso.com -LitigationHoldEnabled $true ` -LitigationHoldDuration Unlimited ` -LitigationHoldOwner "Legal Team" ` -RetentionComment "Held pending HR investigation opened 2024-06-01"
Removing a hold should only happen with explicit authorisation from whoever requested it. Never remove a litigation hold on your own initiative:
Set-Mailbox user@contoso.com -LitigationHoldEnabled $false
List all Purview retention policies in the tenant and their scope:
Get-RetentionCompliancePolicy | Select-Object Name, Enabled, Mode, ExchangeLocation, SharePointLocation, RetentionAction, RetentionDuration
To see what a specific policy retains and for how long:
Get-RetentionComplianceRule -Policy "Policy Name" | Select-Object Name, RetentionDuration, RetentionAction, ExpirationDateOption
Purview retention policies are applied to locations (all mailboxes, specific users, all SharePoint sites), not to individual mailboxes from the Exchange PowerShell side. Scoping changes are made in the Purview compliance portal or via the Security and Compliance PowerShell module (connect with Connect-IPPSSession rather than Connect-ExchangeOnline).
A common MSP scenario: a user leaves, the account needs to be disabled or deleted, but the mailbox content must be kept. The options, in order of preference:
Place a litigation hold before disabling the account. Disable sign-in, remove the licence (a shared mailbox does not need a licence), and convert to a shared mailbox if others need access. The hold preserves everything.
If the account will be deleted entirely, litigation hold alone is not enough once the mailbox is hard-deleted; the content enters a 30-day soft-delete window. Use an inactive mailbox instead: removing the licence from a mailbox on litigation hold converts it to an inactive mailbox, which is retained indefinitely at no additional licence cost and is searchable via eDiscovery.
# Before removing licence, confirm hold is in place: Get-Mailbox user@contoso.com | Select-Object LitigationHoldEnabled # Then remove the licence via Entra ID or M365 admin center # The mailbox becomes inactive and is retained