Managing Microsoft Purview Data Lifecycle Management

Planning the lifecycle of your organization’s data is a crucial task for Microsoft 365 compliance administrators, and it is vital to have the correct strategy in place to ensure that your organization is protected and compliant. There are several ways to manage the lifecycle of the data hosted in your Microsoft 365 environment, the principles of which will be introduced in this chapter. You will learn how to view and interpret Data Lifecycle Management reports and dashboards, configure retention labels and policies, configure retention within Microsoft 365 workloads, find and recover deleted Office 365 data, and configure and use adaptive scopes.

These topics will be covered in the following order:

• Planning for data lifecycle management
• Analyzing reports and dashboards
• Configuring retention labels and policies
• Planning and implementing adaptive scopes
• Finding and recovering deleted Microsoft 365...

Planning for data lifecycle management

The complexity and volume of data that is stored and processed by organizations is ever increasing. Data can be stored within email messages, documents, Teams chat and channel messages, and more. It has never been more crucial to effectively manage and govern the data that you store in order to do the following:

• Comply with internal policies or industry regulations and retain content for only as long as it is needed
• Permanently delete old and unnecessary content to reduce risk in the event of a security breach or litigation
• Ensure that your organization’s employees work only with content that is current and relevant

The starting point for compliance administrators when planning for data lifecycle management is retention. With retention labels and policies in Microsoft 365, you can take actions that will either retain or delete content in line with the set retention periods. This will result in the following outcomes...

Analyzing reports and dashboards

Microsoft provides administrators with a great deal of information relating to data lifecycle management, which can be accessed from the Microsoft Purview compliance portal. Regularly reviewing this information enables you to stay one step ahead in ensuring that your organization meets its compliance and regulatory obligations. It also allows you to make logical adjustments to the existing compliance settings that you have already configured. The Microsoft Purview Data classification page provides you with visibility on the following details:

• Items classified as a sensitive information type (SIT) and what those classifications are
• The most frequently applied sensitivity labels
• The most frequently applied retention labels
• A summary of activities that users are carrying out on your sensitive content
• The locations of your sensitive and retained data

In order to view this information in the Microsoft Purview compliance portal...

Configuring retention labels and policies

In this section, we will learn how to create retention labels, retention label policies, and retention policies and apply them to Microsoft 365 workloads, including Exchange Online, SharePoint Online, OneDrive, and Teams, from the Microsoft Purview compliance portal.

Retention labels are generally intended for when you need exceptions to your retention policies. Typically, you would use retention labels to retain specific items for longer periods than an applied retention policy. For example, you may set retention policies on SharePoint sites to retain content for five years. However, you may also have some documents within the SharePoint site that need to be retained for a longer period—say seven years—for regulatory compliance reasons. Retention labels could be applied to that content. First, we will see how retention labels are used at the item level and applied to content with retention label policies, and then how retention...

Creating a retention policy

As stated earlier in the chapter, retention policies are used to retain content at the service or container level. This means that retention is applied broadly and, as already demonstrated, you can make any exceptions using retention labels. Also note that users never have the option to apply retention policies themselves. It is something that happens automatically without any user involvement. Administrators must create retention policies based on organizational policies or regulatory obligations.

To create retention policies within Microsoft Purview, complete the following steps:

1. Log in to the Microsoft Purview compliance portal at https://compliance.microsoft.com, then navigate to Data lifecycle management | Microsoft 365 and click on the Retention policies tab. You will then see the list of policies, as shown in the following screenshot:

Figure 13.30: Retention policies tab in the Microsoft Purview Data lifecycle...

Planning and implementing adaptive scopes

As you have already seen in this chapter, when you create a retention policy or retention label policy, you are required to choose between adaptive and static scope types to define the scope of the policy. In previous examples, you have used static scopes wherein the administrator chooses the locations and the criteria for retention. Static scopes have more limited configuration options, such as including or excluding locations and instances within those locations.

With adaptive scopes, you can specify queries that enable the dynamic inclusion of users who should be targeted by the scope. Adaptive scopes run daily to pick up any changes that may apply, such as a new user account being added to Microsoft 365 that has a department field selection or a job title selection that matches an adaptive scope query. It is possible to use multiple adaptive scopes within a single policy.

Some advantages of using adaptive scopes include the following...

Finding and recovering deleted Microsoft 365 data

In addition to retention, it is important to have an understanding of what happens when content is deleted from locations in Microsoft 365 and what steps you can take to recover that content. First, let’s take a look at how this applies to user mailboxes.

User mailboxes

There are two types of deleted Exchange Online user mailboxes. These are hard-deleted mailboxes and soft-deleted mailboxes:

• A hard-deleted mailbox is a mailbox that has been soft-deleted for more than 30 days, and the associated Azure AD user has been hard-deleted. There are various scenarios that can apply to hard-deleted mailboxes. Refer to the Further reading section for links to more information about this. Hard-deleted mailboxes cannot be recovered.
• A soft-deleted mailbox is one that has been deleted either via the Microsoft 365 admin center or using the Remove-Mailbox PowerShell cmdlet, after which it has remained in the Azure AD recycle...

Summary

In this chapter, we were introduced to the principles of data lifecycle management and retention within Microsoft 365. We learned how to use Microsoft Purview dashboards for data classification, view Content explorer to see where sensitive info is detected in Microsoft 365 locations, and utilize Activity explorer to view user activity such as applying a label. We also learned how retention policies in Microsoft Purview are used to retain content at the container level to comply with organizational policies and regulatory requirements, and how retention labels can be used as exceptions to those policies when item-level content such as individual documents need different retention settings from those more broadly applied by retention policies. Finally, we learned how content can be recovered if deleted from Microsoft 365, such as mailboxes and OneDrive.

In the next chapter, we will learn about managing and analyzing audit logs in Microsoft Purview. We will examine the concepts...

Questions

1. When a user object is soft-deleted from Microsoft 365, how many days do you have to recover the user mailbox before it is permanently deleted?
   1. 60 days
   2. 30 days
   3. 120 days
   4. 90 days
2. True or false? Retention labels can be used as exceptions to your retention policies.
   1. True
   2. False
3. Which of the following locations cannot be present in a retention policy designed to cover all Microsoft 365 locations? (Choose all that apply)
   1. Exchange email
   2. Teams chat
   3. SharePoint sites
   4. Teams channel messages
   5. OneDrive
   6. Teams private channel messages
4. Which feature in Microsoft Purview would you use to identify Microsoft 365 data containing sensitive info?
   1. Activity explorer
   2. Content explorer
   3. Alert policies
   4. Assessments
5. True or false? Adaptive scopes require an M365 E5 license.
   1. True
   2. False
6. Which two sections in Microsoft Purview can be used to configure retention labels?
   1. Data classification
   2. Data lifecycle management
   3. Records management
   4. Compliance manager
7. What will happen if you try to include Teams channel...

Further reading

Please refer to the following links for more information:

• How to use the Microsoft data classification dashboard: https://learn.microsoft.com/en-us/microsoft-365/compliance/data-classification-overview?WT.mc_id=M365-MVP-4039827&view=o365-worldwide
• Get started with activity explorer: https://learn.microsoft.com/en-us/microsoft-365/compliance/data-classification-activity-explorer?view=o365-worldwide
• Learn about retention policies and retention labels: https://learn.microsoft.com/en-us/microsoft-365/compliance/retention?WT.mc_id=M365-MVP-4039827&view=o365-worldwide
• Common settings for retention policies and retention label policies: https://learn.microsoft.com/en-us/microsoft-365/compliance/retention-settings?WT.mc_id=M365-MVP-4039827&view=o365-worldwide
• Create and configure retention policies: https://learn.microsoft.com/en-us/microsoft-365/compliance/create-retention-policies?WT.mc_id=M365-MVP-4039827&view=o365-worldwide
• Create...