How to Create a Custom Office 365 Retention Policy

An Office 365 retention policy helps you manage the email lifecycle and minimize potential legal risks by establishing a maximum timeframe emails are kept. Microsoft routinely updates the default policies for messaging records management (MRM). For instance, deleted emails in Office 365 were once only recoverable up to 30 days. Microsoft updated its retention policy so all emails are now recoverable, regardless whether users delete them.

However, to better manage emails and stay industry-compliant, you should configure your own custom retention policy in Office 365.

Setting Up an Office 365 Retention Policy

Before getting started, it’s important to note that a mailbox can only have one retention policy assigned to it, and users can still delete emails, even with an Office 365 retention policy in place.

To apply a retention policy to a mailbox, you’ll need to use retention tags. These settings outline the period a message should remain in a mailbox and what happens once that timeframe has passed.

Here’s how to create a custom Office 365 retention policy and assign retention tags:

  1. Browse to Office 365 Admin > Exchange admin center > compliance management > retention policies. create Office 365 retention policy

  2. Select Default MRM Policy, click the edit icon and then change the name of the policy.

Note: Microsoft periodically updates the default policy titled “Default MRM Policy.” By changing the name of the policy, you will be exempt from Microsoft-initiated changes to mail retention.

  1. Next browse to Office 365 Admin > Exchange admin center > compliance management > retention tags.

  2. Create retention tags by clicking the button and selecting the desired scope. Customer Retetention Policy          

  3. After creating desired retention policies, browse back to Office 365 Admin > Exchange admin center > compliance management > retention policies and click the icon.

  4. Specify a name for the new retention policy, choose your newly created tags and click save. naming retention policy Exchange

Have more questions about creating Office 365 retention policies? Let us know your questions in the comments below. For more help managing your Office 365 environment, check out our Office 365 consulting services here, or request a quote:

ON THIS PAGE

Looking to hire an MSP for CMMC?

Click the button below now.

Lorem ipsum dolor sit amet,

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec

Compliance Isn't a Checkbox

It’s contract eligibility. Agile IT builds, secures, and validates Microsoft 365, GCC High, and Azure environments for organizations facing CMMC, NIST 800-171, and CUI requirements. If a failed audit would cost you contracts, talk to us before it does.

Related Posts

What Counts as CUI in Microsoft 365 and Azure Government

Most CUI scope decisions get made in one meeting, by whoever is in the room, and documented afterward to match. That boundary holds until a C3PAO asks who justified it. The designating agency decides what qualifies. Data flow decides what’s in scope. The Microsoft environment follows both, not the reverse.

Read More »