Forum Discussion
Email Retention Policy Editing and Deletion Mechanism is Broken and Unpredictable - Purview
We experienced a critical failure in how Microsoft Purview retention policies behave when mistakes happen:
A retention policy was mistakenly created that automatically deletes emails older than 14 days, and it was accidentally applied to all mailboxes.
Once the error was discovered, we tried to disable or delete the policy — but it was locked and completely uneditable.
For days, it was impossible to make any changes to the policy — no disable, no scope edit, no deletion.
Eventually, after Microsoft made some backend change, we saw the policy move into "PendingDeletion" state — still without any way to confirm whether it's active or being enforced.
Using PowerShell, we finally managed to force-remove the policy via Remove-RetentionCompliancePolicy -Force.
The policy no longer appears in any list — but some mailboxes still show the 14-day retention tag, and emails are still being deleted.
Other mailboxes seem unaffected — completely inconsistent behavior. Start-ManagedFolderAssistant doesn't reliably refresh mailbox state.
Some users update, others don’t. The LastProcessedTime is often empty. There's no logging or status information per mailbox, so admins have no visibility into whether a policy was applied, processed, or reverted.
Even worse: some users are still receiving the now-deleted policy as if it were being applied freshly, long after deletion. This suggests that Microsoft may be asynchronously processing a cached sequence of updates, executing actions even if the current policy no longer exists. That’s deeply problematic and can cause serious, silent data loss across the organization.
There’s also been no meaningful support from Microsoft.
They did call us yesterday, but were unable to provide any useful information. All we were told is that they're "waiting to see what happens with the pending deletion state," which clearly shows they have no real insight into the system’s behavior or recovery process. We’re essentially on our own, hoping the system will eventually correct itself.
What Microsoft must improve:
Admins need a way to immediately stop or reverse a policy across all mailboxes.
There must be clear visibility into what policy is active per mailbox.
A status dashboard for policy enforcement would prevent blind troubleshooting.
The system must log and expose retention actions on a per-mailbox level.
PendingDeletion must actually mean the policy is not being enforced anymore.
Right now, compliance policies behave like a black box, and once something goes wrong, admins have no way out. This is not acceptable for production environments.
2 Replies
- alfikidsCopper Contributor
Thank you for your reply!
We have done everything mentioned before but didn't help.
Policy, which didn't exist anymore, was still applied to the mailboxes, deleting emails, and even with all those commands run nothing helped.
- GageSterlingIron Contributor
1. Immediate fixes
Run the force policy application command:
powershell
# Enforce the policy immediately for all users
Get-Mailbox | Start-ManagedFolderAssistant
# Execute on a single problem user
Start-ManagedFolderAssistant -Identity “email address removed for privacy reasons”
2. 3 configurations that must be checked
Unpause reservations:
powershell
Set-Mailbox -Identity “email address removed for privacy reasons” -RetentionHoldEnabled $false
Verify the policy assignment:
powershell
Get-Mailbox “email address removed for privacy reasons” | Select RetentionPolicy
Check the policy priority:
powershell
Get-RetentionPolicy | Sort-Object Priority | ft Name,Priority
3. Emergency recovery of deleted emails
powershell
# Recover emails deleted by policy within 7 days.
Search-Mailbox -Identity “email address removed for privacy reasons” -SearchQuery 'kind:deleteditems' -TargetMailbox “email address removed for privacy reasons” -TargetFolder “Recovered_ Items” -DeleteContent
4. Service status check
powershell
# Confirm the status of background services
Get-Service MSExchangeMailboxAssistants | Select Status,StartType