Issue

Lack of clear guidelines to define
(a) the target retention configuration (GWS-aligned vs Purview default)

(b) the safe and controlled point in time—and conditions—under which retention should be turned on, given the potential for automatic deletion of user data.

Recommendation

A.1) Purview default OFF Day 1

Background & Context

Syensqo currently does not have formally defined or approved guidelines specifying how data retention should be configured and enforced across collaboration platforms.

As part of the Microsoft 365 implementation, a Data Retention Policy must be established in Microsoft Purview to ensure consistent information governance, compliance readiness (e.g., audit/eDiscovery), and lifecycle management of corporate data (email, files, Teams content, etc.).

Because no business owner or governance body has taken a decision to date, the solution design has proceeded using the Microsoft Purview default retention configuration as the proposed baseline. This default-based setup was selected primarily to avoid blocking the implementation progress in the absence of a clear corporate retention standard.

Assumptions

• Microsoft Purview retention must be configured to support information governance, auditability, and eDiscovery readiness for M365 data (Exchange, SharePoint, OneDrive, Teams, etc.).
• Once enabled and depending on policy settings, retention enforcement can lead to automatic deletion when items meet retention criteria; recovery options may be limited or time-bound.
• The solution design proposes and has set up Microsoft Purview default retention settings because no decision owner/body has confirmed an alternative approach.

Constraints / Impacts

• A safe activation typically requires testing, stakeholder communication, change management, and monitoring; “big-bang” enablement is constrained by limited ability to predict impact.
• Existing data (including migrated content) may already be older than proposed retention thresholds; enabling deletion-based retention could affect large volumes immediately.
• Since no classification or sensitivity/retention labeling is currently deployed, retention cannot be reliably targeted based on content category (e.g., records vs. transitory content). This constrains us to broader, location- or workload-based retention policies until labeling is implemented.

Options considered

Option 1) Purview default OFF Day 1

Option 2): Purview default ON Day 1 

Option 3): Replicate GWS as-is in Purview

Evaluation

Criteria	1) Purview default OFF Day 1	2) Purview default ON Day 1	3) Replicate GWS as-is in Purview
Technical Feasibility	High – keep configuration but don’t enforce.	High – enable existing policies; minimal extra build.	Medium – change policies to “forever” for Teams/Mail; validate workload coverage and exceptions.
User Impact	Low now – no user-visible deletions triggered by retention.	Medium (delayed) – deletion risk mainly when items age beyond 10 years (Teams/Mail); not immediate for most users.	Medium – minimal deletion impact, but larger eDiscovery scope and long-lived content footprint for users.
Support Impact	Low – fewer “missing data” tickets;	Medium – requires readiness for retention questions and potential deletion/escalations (even if most impact is long-term).	Medium – fewer deletion tickets, but more support for search/eDiscovery volume, mailbox/Teams history expectations, and data minimization concerns.
Operational Complexity	Low – buys time to confirm governance and rollout plan before enforcement.	Medium – needs comms, monitoring, hold process clarity, and validation that litigation overrides work as intended.	/ Medium–High – requires governance justification for “retain forever” + ongoing review (why forever, for which populations, and how to manage growth).
Cost	Low – lowest immediate effort; potential future project effort to enable.	/ Low–Medium – low config effort, but more change management and operational readiness work.	Medium – more design/approval effort + likely higher long-term storage/eDiscovery handling costs.

Main risk per option:

• 1) (OFF): Retention not enforced → continued policy gap and delayed compliance control.

• 2) (ON): Enforcing 10-year retention for Teams/Mail may later delete historical data if not aligned with legal/business needs.

• 3) (GWS as-is): “Retain forever” for Teams/Mail increases over-retention risk (privacy/data minimization) and inflates eDiscovery and long-term data footprint.

See also

The following section describes relevant documentation: