SOLVED

Does a M365 retention policy with retain/delete prevent complete deletion?

%3CLINGO-SUB%20id%3D%22lingo-sub-1435430%22%20slang%3D%22en-US%22%3EDoes%20a%20M365%20retention%20policy%20with%20retain%2Fdelete%20prevent%20complete%20deletion%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1435430%22%20slang%3D%22en-US%22%3E%3CP%3EWhat%20happens%20to%20emails%20when%20(a)%20an%20active%20Microsoft%20365%20retention%20policy%2C%20with%20a%20setting%20of%20'retain%20then%20delete'%20after%20a%20given%20period%2C%20is%20still%20active%20on%20the%20mailbox%2C%20and%20(b)%20an%20end-user%20empties%20the%20'Recoverable%20items'%20folder%20via%20their%20Outlook%20client%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAre%20the%20emails%20from%20the%20Recoverable%20Items%20folder%20moved%20to%20a%20different%20folder%2C%20and%20if%20yes%2C%20which%20one%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAccording%20to%20the%20Docs%20page%20titled%20'Learn%20about%20retention%20policies%20in%20Exchange'%20(%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcompliance%2Fretention-policies-exchange%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcompliance%2Fretention-policies-exchange%3C%2FA%3E)%2C%20%3A%20'If%20the%20item%20is%20modified%20or%20permanently%20deleted%20by%20the%20user%20(either%20SHIFT%2BDELETE%20or%20deleted%20from%20Deleted%20Items)%20during%20the%20retention%20period%3A%20The%20item%20is%20moved%20(or%20copied%2C%20in%20the%20case%20of%20edit)%20to%20the%20Recoverable%20Items%20folder.%20There%2C%20a%20timer%20job%20runs%20periodically%20and%20identifies%20items%20whose%20retention%20period%20has%20expired%2C%20and%20these%20items%20are%20permanently%20deleted%20within%2014%20days%20of%20the%20end%20of%20the%20retention%20period'.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20above%20quote%20seems%20to%20say%20that%20if%20the%20emails%20are%20deleted%20but%20a%20retention%20policy%20is%20still%20active%2C%20the%20emails%20will%20not%20be%20deleted%20permanently%20and%20should%20continue%20to%20be%20recoverable.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1435912%22%20slang%3D%22en-US%22%3ERe%3A%20Does%20a%20M365%20retention%20policy%20with%20retain%2Fdelete%20prevent%20complete%20deletion%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1435912%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F4163%22%20target%3D%22_blank%22%3E%40Andrew%20Warland%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThat%20is%20an%20interesting%20question%2C%20and%20not%20a%20scenario%20I%20have%20specifically%20tested%2C%20but%20I%20would%20imagine%20that%20the%20principal%20of%20%22retention%20wins%20over%20deletion%22%20would%20continue%20to%20apply.%26nbsp%3B%20So%20when%20emptying%20the%20recoverable%20items%20folder%20I%20don't%20believe%20the%20%22copy%22%20could%20be%20deleted.%26nbsp%3B%20In%20fact%2C%20and%20I'd%20have%20to%20double%20check%20this%2C%20but%20I'm%20pretty%20certain%20that%20despite%20the%20copy%20residing%20in%20the%20recoverable%20items%20folder%2C%20that%20it%20does%20so%20in%20a%20folder%20which%20is%20hidden%20and%20inaccessible%20to%20the%20user.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1436967%22%20slang%3D%22en-US%22%3ERe%3A%20Does%20a%20M365%20retention%20policy%20with%20retain%2Fdelete%20prevent%20complete%20deletion%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1436967%22%20slang%3D%22en-US%22%3E%3CP%3EThat's%20indeed%20the%20case.%20Users%20cannot%20access%20any%20content%20held%20within%20the%20Purges%20or%20DiscoveryHolds%20folder%2C%20where%20such%20items%20are%20kept%20for%20the%20duration%20of%20the%20retention%20period.%20Such%20items%20are%20only%20accessible%20via%20content%20search%2FeDiscovery.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1437565%22%20slang%3D%22en-US%22%3ERe%3A%20Does%20a%20M365%20retention%20policy%20with%20retain%2Fdelete%20prevent%20complete%20deletion%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1437565%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20confirming%20Vasil.%26nbsp%3B%20Was%20on%20the%20move%20when%20I%20responded%20and%20couldn't%20remember%20for%20certain%20about%20this.%26nbsp%3B%26nbsp%3B%3CIMG%20class%3D%22lia-deferred-image%20lia-image-emoji%22%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Fhtml%2Fimages%2Femoticons%2Fsmile_40x40.gif%22%20alt%3D%22%3Asmile%3A%22%20title%3D%22%3Asmile%3A%22%20%2F%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1438752%22%20slang%3D%22en-US%22%3ERe%3A%20Does%20a%20M365%20retention%20policy%20with%20retain%2Fdelete%20prevent%20complete%20deletion%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1438752%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3Bthank%20you%20Vasil%2C%20much%20appreciated!%20By%20the%20way%2C%20do%20you%20know%20if%20a%20'delete%20after%20n%20period'%20in%20the%20old%20MRM%20policy%20also%20kept%20the%20email%20in%20a%20hidden%20folder%3F%20Office%20365%20for%20IT%20Pros%20seems%20to%20say%20that%2C%20but%20as%20I%20can't%20get%20to%20those%20hidden%20folders%20I%20don't%20know%20for%20sure.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1438800%22%20slang%3D%22en-US%22%3ERe%3A%20Does%20a%20M365%20retention%20policy%20with%20retain%2Fdelete%20prevent%20complete%20deletion%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1438800%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F616707%22%20target%3D%22_blank%22%3E%40PeterRising%3C%2FA%3E%26nbsp%3Bthanks%20Peter%2C%20it's%20good%20to%20have%20this%20confirmed.%20The%20question%20started%20with%20'delete%20after%20n%20period%20of%20time'%20with%20MRM%20tags%20but%20it%20then%20became%20a%20question%20of%20exactly%20which%20subfolder%20in%20the%20Recoverable%20Items%20folder%20the%20'purged'%20(by%20end%20users)%20items%20went%20to.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1439479%22%20slang%3D%22en-US%22%3ERe%3A%20Does%20a%20M365%20retention%20policy%20with%20retain%2Fdelete%20prevent%20complete%20deletion%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1439479%22%20slang%3D%22en-US%22%3E%3CP%3EDepends.%20With%20the%20default%20settings%20(Single%20item%20recovery%20enabled)%2C%20every%20deleted%20item%20is%20kept%20for%2014%20days%20in%20the%20Purges%20folder%2C%20regardless%20of%20how%20it%20was%20deleted.%20If%20SIR%20is%20not%20enabled%2C%20items%20can%20be%20immediately%20%22purged%22%20though.%20And%20if%20a%20hold%20is%20enabled%20on%20the%20mailbox%2C%20the%2014%20days%20period%20is%20changed%20to%20the%20hold%20duration%20or%20indefinite.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Regular Contributor

What happens to emails when (a) an active Microsoft 365 retention policy, with a setting of 'retain then delete' after a given period, is still active on the mailbox, and (b) an end-user empties the 'Recoverable items' folder via their Outlook client?

 

Are the emails from the Recoverable Items folder moved to a different folder, and if yes, which one? 

 

According to the Docs page titled 'Learn about retention policies in Exchange' (https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies-exchange), : 'If the item is modified or permanently deleted by the user (either SHIFT+DELETE or deleted from Deleted Items) during the retention period: The item is moved (or copied, in the case of edit) to the Recoverable Items folder. There, a timer job runs periodically and identifies items whose retention period has expired, and these items are permanently deleted within 14 days of the end of the retention period'.

 

The above quote seems to say that if the emails are deleted but a retention policy is still active, the emails will not be deleted permanently and should continue to be recoverable. 

 

6 Replies
Highlighted

@Andrew Warland 

 

That is an interesting question, and not a scenario I have specifically tested, but I would imagine that the principal of "retention wins over deletion" would continue to apply.  So when emptying the recoverable items folder I don't believe the "copy" could be deleted.  In fact, and I'd have to double check this, but I'm pretty certain that despite the copy residing in the recoverable items folder, that it does so in a folder which is hidden and inaccessible to the user.

Highlighted
Best Response confirmed by Andrew Warland (Regular Contributor)
Solution

That's indeed the case. Users cannot access any content held within the Purges or DiscoveryHolds folder, where such items are kept for the duration of the retention period. Such items are only accessible via content search/eDiscovery.

Highlighted

@Vasil Michev 

 

Thanks for confirming Vasil.  Was on the move when I responded and couldn't remember for certain about this.  :smile:

Highlighted

@Vasil Michev thank you Vasil, much appreciated! By the way, do you know if a 'delete after n period' in the old MRM policy also kept the email in a hidden folder? Office 365 for IT Pros seems to say that, but as I can't get to those hidden folders I don't know for sure. 

Highlighted

@PeterRising thanks Peter, it's good to have this confirmed. The question started with 'delete after n period of time' with MRM tags but it then became a question of exactly which subfolder in the Recoverable Items folder the 'purged' (by end users) items went to. 

Highlighted

Depends. With the default settings (Single item recovery enabled), every deleted item is kept for 14 days in the Purges folder, regardless of how it was deleted. If SIR is not enabled, items can be immediately "purged" though. And if a hold is enabled on the mailbox, the 14 days period is changed to the hold duration or indefinite.