A deleted email is not always a deleted business record. It may contain a customer agreement, a pricing decision, a safety instruction or evidence needed for a dispute months later. Knowing how to configure email retention gives your organisation a controlled way to keep the messages that matter, remove those that do not, and avoid relying on individual inbox habits.
For most businesses, email retention is not simply an IT housekeeping task. It sits at the meeting point of operational continuity, data protection, cyber security and storage management. A sensible policy helps staff find information when they need it, while reducing the volume of old data that could be exposed or needlessly retained.
Start with the business reason, not the settings
Before opening Microsoft 365 administration tools, decide what your business needs to retain and why. The right retention period is rarely the same for every message. Finance correspondence, signed contracts, HR matters and client project records may all have different commercial or regulatory requirements.
Avoid setting a long retention period for every mailbox simply because it feels safer. Keeping everything indefinitely can create problems of its own. It increases the amount of information available during a legal disclosure request, makes searches less efficient and can conflict with data minimisation principles under GDPR.
Build the policy around clear record categories. For a typical Irish business, this may include financial records, contract and supplier communications, customer correspondence, HR-related mailboxes and general day-to-day messages. Speak with the people responsible for finance, operations, HR and compliance before deciding on periods. Where legal or sector-specific obligations apply, seek appropriate legal or regulatory advice rather than treating a technical setting as compliance confirmation.
A short policy document should state who it applies to, which mailboxes and message types are covered, the retention period, what happens when that period ends, and who can approve exceptions. This gives IT a workable specification and gives managers a defensible basis for the decision.
Understand retention, archiving and backup
These terms are often used interchangeably, but they serve different purposes.
Email retention controls how long a message is preserved or kept within the Microsoft 365 environment. A retention policy can retain content even if a user deletes it, and it can be configured to delete items after a defined period. This is particularly useful when business records must be protected from accidental deletion or a departing employee clearing their mailbox.
Archiving moves older messages out of the primary mailbox into an archive mailbox. It can improve mailbox usability and help users manage large inboxes, but it does not automatically meet a records retention requirement. An archived message can still be deleted unless a retention policy protects it.
Backup is for recovery. A proper Microsoft 365 backup service can provide a separate recovery point for mailboxes, files and collaboration data following deletion, corruption or a security incident. It is not a substitute for a retention policy, and retention is not a substitute for backup. One preserves records according to rules; the other helps restore data when something goes wrong.
How to configure email retention in Microsoft 365
For many organisations, Microsoft Purview is the appropriate place to manage retention at scale. The exact options available depend on your Microsoft 365 licence, so check your subscription and administrative permissions before planning the rollout.
Begin by reviewing existing policies and labels. It is common to find a legacy Exchange retention tag, an archive rule or an older policy already in place. Introducing a new policy without understanding the existing configuration can lead to unexpected results, including messages moving to archive or being deleted sooner than intended.
In the Microsoft Purview portal, create a retention policy and give it a name that explains its purpose, such as “Finance email – seven years” or “General business email – three years”. Select the locations it should cover. For email, this will usually be Exchange mailboxes, although your wider records policy may also apply to Teams, SharePoint and OneDrive.
Next, choose whether the policy should retain content, delete content, or do both. A common approach is to retain mail for a defined period and then delete it automatically when the period expires. The retention period can be based on when an item was created, last modified or labelled. Creation date is often easier to explain and govern, but the appropriate choice depends on the record type and the business rule behind it.
Choose the scope carefully. A policy can apply to all mailboxes, specific users, Microsoft 365 groups or selected locations. Start with a controlled group where possible. Finance or a small operational team can provide a useful pilot, allowing IT to confirm that the policy behaves as expected before rolling it out organisation-wide.
Retention labels are useful when not every email should follow the same rule. A label lets a user or administrator apply a specific retention category to a message or folder, such as “Contract record – retain seven years”. This offers more precision, but it also depends on staff applying labels correctly. For most small and medium-sized businesses, broad policies for standard mail and labels for defined exceptions are more practical than expecting users to classify every message.
Use deletion rules with care
Automatic deletion is valuable when it is based on a clear, approved schedule. It reduces clutter and helps prevent personal data sitting in mailboxes for longer than necessary. It can also make storage planning more predictable.
However, automatic deletion needs testing. A poorly scoped policy can remove material that a team still needs for an active client, a warranty claim or an audit. It is generally safer to introduce retention first, monitor the outcome and only then activate deletion after stakeholders have signed off the proposed timeframes.
Be especially cautious with shared mailboxes. A mailbox used for sales enquiries, customer support or accounts payable can hold records on behalf of the whole business. Its retention settings should reflect the function of the mailbox, not the preferences of the person currently managing it.
Protect investigations and exceptional cases
A standard retention rule should not override an active legal, HR or regulatory requirement to preserve information. Microsoft 365 provides eDiscovery and legal hold capabilities that can preserve relevant email when an investigation, dispute or subject access process requires it.
This is why ownership matters. IT can apply the configuration, but the decision to place a mailbox or content set on hold should be managed through an agreed process involving the appropriate business leaders, HR team, compliance contact or legal adviser. Keep a record of who authorised the hold, what it covers and when it should be reviewed.
Retention policies also need access controls. Limit who can create, amend or remove them, and use separate administrator accounts where appropriate. Changes to retention can have wide-ranging consequences, so they should be included in your normal change control process rather than being treated as a quick mailbox fix.
Test, document and review the policy
Microsoft 365 retention does not always take effect immediately. Policies can take time to process, and outcomes may not be visible in a user’s mailbox in the way they expect. Test using sample content and a pilot group before relying on the policy in a compliance-sensitive situation.
Your test should confirm that retained messages remain discoverable after a user deletes them, that archive rules do not conflict with retention, and that expiry actions match the approved schedule. Check shared mailboxes, leavers’ mailboxes and any high-value departments separately. These are frequent sources of overlooked data.
Document the final configuration in plain English as well as technical detail. Include policy names, scopes, exclusions, retention periods, deletion actions, responsible owners and review dates. Staff do not need a lengthy technical manual, but they should understand the practical rule: which email must be kept, where it should be stored and when they need to ask for help.
Review the policy at least annually and whenever your business changes. A new finance system, acquisition, office move, regulated contract or revised HR process may change what you need to retain. LANCAST can help businesses assess their Microsoft 365 setup, apply workable retention controls and align email protection with backup, security and day-to-day support.
A well-configured retention policy should make email less of a personal filing cabinet and more of a managed business record. Set rules that staff can follow, test them before relying on them, and keep reviewing them as your organisation grows.