Explore Microsoft Purview Records Management
The Microsoft Purview Records Management solution enables organizations to manage their high-value content for legal, business, or regulatory obligations. Organizations that plan to implement the Microsoft Purview Records Management solution should complete the following steps to get started:
- Understand how retention and deletion works in Microsoft 365. Then identify whether you must use retention policies to supplement retention labels that manage documents and emails at the item level. If necessary, create retention policies for baseline governance of data across Microsoft 365 workloads.
- Understand the Microsoft Purview Records Management solution. Learn how to use retention labels to allow or block actions when an organization's records management team declares documents and emails as records.
- Create your file plan for retention and deletion settings and actions. Determine when your organization's records management team should mark items as records. If it has an existing plan, it can do so by importing the plan. Or, it can create new retention labels. For more information, see Use file plan to create and manage retention labels.
- Publish and apply your retention labels. Retention labels are reusable building blocks that organizations can use in multiple policies and can incorporate into user workflows:
Note
A later training module covers retention labels, tags, and policies.
Subscription and licensing requirements
Many different subscriptions support Microsoft Purview Records Management. The licensing requirements for users depend on the features you use.
- To see the options for licensing your users to benefit from Microsoft Purview features, see the Microsoft 365 licensing guidance for security & compliance.
- For records management, see the Microsoft Purview Records Management section and related PDF download for feature-level licensing requirements.
Permissions
An organization's compliance team members who are responsible for records management need permissions to the Microsoft Purview compliance portal. By default, the tenant admin (global administrator) has access to this location and can give compliance officers and other people access without giving them all the permissions of a tenant admin.
- To grant permissions for this limited administration, Microsoft recommends that organizations add users to the records management admin role group. This role group grants permissions for all features related to records management, including disposition review and verification.
- For a read-only role, you can create a new role group and add the View-Only Record Management role to this group.
Microsoft Purview Records Management only requires these permissions to create, configure, and apply retention labels that declare records, and to manage disposition. The person configuring these labels doesn't require access to the content.
Additional reading. For instructions to add users to the default roles or create your own role groups, see Permissions in the Microsoft Purview compliance portal.
Common records management scenarios and supporting documentation
An organization should use the following table to help map its business requirements to the scenarios supported by Microsoft Purview Records Management.
Tip
Need to comply with a specific industry regulation? Check Regulatory requirements for data lifecycle management and records management for regulation-specific guidance.
| I want to... | Documentation |
|---|---|
| Declare a record. | Declare records by using retention labels. |
| Update a record. | Use record versioning to update records stored in SharePoint or OneDrive. |
| Let administrators and users manually apply retain and delete actions for documents and emails: - SharePoint - OneDrive - Outlook and Outlook on the web |
Publish retention labels and apply them in apps. |
| Let site administrators set default retain and delete actions for all content in a SharePoint library, folder, or document set. | Publish retention labels and apply them in apps. |
| Let users automatically apply retain and delete actions to emails by using Outlook rules. | Publish retention labels and apply them in apps. |
| Let administrators apply both retain and delete actions to a document understanding model. By doing so, the system automatically applies these actions to identified documents in a SharePoint library. | Publish retention labels and apply them in apps. |
| Automatically apply retain and delete actions to documents and emails. | Apply a retention label to content automatically. |
| Start the retention period when an event occurs, such as: - Employees leave the organization. - Contracts expire. - End of product lifetime. |
Start retention when an event occurs. |
| Restrict changes to policies to help meet regulatory requirements or safeguard against rogue administrators. | Use Preservation Lock to restrict changes to retention policies and retention label policies. |
| Manage the lifecycle of different document types in SharePoint. | Use retention labels to manage the lifecycle of documents stored in SharePoint. |
| Apply a retention label to a file when either: - I receive an alert indicating the system stored content containing personal data for too long. - The content remained untouched for too long. |
Investigate and remediate alerts in Privacy Risk Management. |
| Make sure somebody reviews and approves before the system deletes content at the end of its retention period. | Disposition reviews. |
| Have proof of disposition for content the system permanently deletes at the end of its retention period. | Disposition of records. |
| Monitor how and where the system applies retain and delete settings to items. | Monitoring retention labels. |
End-user documentation
If you're using retention policies for baseline data governance, they typically work unobtrusively in the background without user interaction. As a result, they need little documentation for users. Retention policies for Teams inform users when the system deletes their messages by sending them a link to Teams messages about retention policies.
In comparison, retention labels have a UI presence in Microsoft 365 apps. As a result, organizations should ensure they provide guidance for end users and their help desk before they deploy these labels to their production networks. To help users apply retention labels in SharePoint and OneDrive, and information about unlocking records for editing, see Apply retention labels to files in SharePoint or OneDrive.
However, customized guidance and instructions provide the most effective end-user documentation. This scenario is especially true when organizations provide customized instruction for retention label names and configurations they choose. For more information that you can use to help train your users, see End User Training for Retention Labels.
Knowledge check
Choose the best response for the following question. Then select “Check your answers.”