Compliance and Retention Policies Flashcards

An organization needs to retain all Microsoft Teams channel messages for its 'Executives' user group for 10 years. All other users' Teams messages must be deleted after 3 years. What is the most effective way to configure this using Microsoft Purview retention policies?

Answer: Create two separate retention policies for Teams. Scope one policy to the Executives group for 10 years and a second policy to all other users for 3 years, excluding the Executives group.

The most direct and effective method is to use two distinct Microsoft Purview retention policies. One policy is specifically scoped to the 'Executives' group with a 10-year retention period. The second policy is scoped to include all users but explicitly excludes the 'Executives' group, applying the 3-year deletion period. This prevents policy conflicts and precisely targets the correct user populations. MRM does not apply to Teams, and mail flow rules are not used for retention.

What is the fundamental difference between applying a Microsoft Purview retention policy to a location versus applying a retention label to an item?

Answer: A retention policy applies to all items within a container, like a mailbox or site, while a retention label is applied to an individual item, like an email or document.

A retention policy sets a default retention or deletion action for all content within a specified location, such as an entire Exchange mailbox. A retention label, however, is a tag applied to an individual item (email, document) that can override the container's default policy, and can be applied manually by users or automatically based on conditions.

A user's mailbox is placed on Litigation Hold. The user performs several actions within their Outlook client. Which of the following user actions results in a copy of the original item being preserved in the Recoverable Items folder?

Answer: Editing the subject line of a received email and saving the change.

Litigation Hold uses a copy-on-write mechanism to preserve data. When a user attempts to change or delete a mailbox item, a copy of the original, unmodified item is saved in the Recoverable Items folder before the change is committed. Editing the subject of an email is a modification of the item, which triggers the copy-on-write process to preserve the original version. Actions like categorizing or reading an email only change metadata and do not trigger this preservation.

A legal department needs to preserve all emails pertaining to an internal investigation codenamed "Project Falcon" for an indefinite period. The data is spread across multiple users' mailboxes. What is the most precise and efficient method in Microsoft Purview to accomplish this?

Answer: Create a Microsoft Purview eDiscovery (Standard) case, and create a hold associated with the case using the keyword "Project Falcon".

Using a hold associated with a Microsoft Purview eDiscovery case is the most precise method. It allows an administrator to define a query-based hold (e.g., using the keyword "Project Falcon") that preserves only the specific content matching the criteria across specified mailboxes. This avoids placing a broad hold on all content for the users, which is what Litigation Hold would do. Relying on users to apply labels is inefficient and prone to error.

An organization is migrating from on-premises Exchange to Exchange Online and currently uses Messaging Records Management (MRM) policies. To adopt a modern, unified information governance strategy, which Microsoft Purview feature is the recommended replacement for MRM?

Answer: Retention Policies and Retention Labels

Microsoft Purview retention policies and retention labels are the modern, recommended features for information governance across the Microsoft 365 suite. They are designed to replace the legacy, Exchange-only Messaging Records Management (MRM) feature, offering a more unified and powerful set of capabilities for data lifecycle management.

An administrator configures a Microsoft Purview retention policy to delete all emails 7 years after they were created. A specific user's mailbox is also placed on Litigation Hold for an eDiscovery case. What happens to an 8-year-old email in this user's mailbox?

Answer: The email is preserved and cannot be permanently deleted until the Litigation Hold is removed.

Microsoft Purview follows a key 'principle of retention' where preservation always wins over deletion. A Litigation Hold is a form of indefinite preservation. Therefore, even though the retention policy is configured to delete items older than 7 years, the Litigation Hold will override this deletion action and preserve the item until the hold is released.