Microsoft Purview Records Management Implementation

Data lifecycle management is retention hygiene: retention policies and ordinary retention labels that keep content for a period and then delete it, applied broadly so the tenant stops hoarding. Records management is declaration: a file plan that ties each record class to a citation, labels that make an item a record (deletion blocked, edits controlled) or a regulatory record (nothing can be undone), retention that starts on an event, a reviewed disposition rather than a silent deletion, proof of that disposition, and an audit trail. Most organizations need both; they are different work with different owners, which is why the hygiene programme is its own service — Microsoft Purview Data Lifecycle Management Implementation — and this one builds the records program on top of it.

The file plan is the Records Management view of your retention labels with descriptors attached to each: a reference ID, the business function or department that owns the class, category and sub-category, the authority type (a law, a regulation, a contract, an internal policy) and the provision or citation that sets the period. We insist on the citation because it is what an auditor traces: 'why is this kept seven years?' is answered by the label itself, not by whoever remembers. It also disciplines the workshop — a class nobody can cite is usually two classes, or none. The file plan is built in bulk from a spreadsheet and exported at the end as your baseline record.

A record label blocks deletion for the retention period and, when the record is locked, blocks content edits; metadata can still be changed, users with the right permissions can change the label, and in SharePoint record versioning lets a record be unlocked, edited and relocked with the history kept. A regulatory record label removes every one of those escape hatches: once applied, nobody — not a global administrator, not Microsoft support — can remove the label, edit the item or delete it before the period ends, the label cannot be deleted from the tenant, and the only changes allowed to it are a longer period or more locations. Microsoft keeps the option hidden until an administrator enables it with PowerShell. In most file plans a handful of classes, if any, justify it.

Because a scoping mistake with a regulatory record cannot be undone. A mis-applied auto-apply rule with an ordinary record label is an afternoon's correction; the same mistake with a regulatory label is content you will hold until the period expires, whatever it costs you in storage, discovery or embarrassment. So we build and pilot every class with ordinary record labels first, show you exactly which classes the signed file plan marks regulatory, put the irreversibility in writing, and enable the PowerShell switch and apply those labels only after you sign. Declining is a normal outcome — many records programs are complete without a single regulatory label.

With a retention label that has 'mark items as a record' set, published to the site through a label policy. Users pick the label from the item's properties, a library or folder or document set can carry it as a default so everything inside is declared on arrival, and auto-apply policies can declare items by sensitive information type, keyword or trainable classifier. The classic Records Center site, in-place records management and the content organizer are not the way Microsoft builds this any more; the label travels with the item, which means a record in a Team's document library is as much a record as one in a dedicated site.

Most retention periods in a real schedule do not start when a file is created — they start when a contract expires, an employee leaves, a project closes or a product is withdrawn. Event-based retention lets a label's clock start on that event: you define an event type, label items with an asset ID or keyword that ties them to a specific contract or person, and when the event is raised — in the Purview portal, or from an HR or contract system through the Microsoft Graph records management API — Purview synchronizes the date to the matching items, taking up to seven days. We define the event types your plan needs, document the asset-ID convention, and design the automation path; building the integration itself is quoted separately.

For any class you choose, the label sends items to a review at the end of their period instead of deleting them silently. Reviewers — individuals or mail-enabled security groups — are notified, see the item (which requires the Disposition Management role and the content-viewing permissions we assign), and choose to approve disposal, extend retention, apply a different label, or add another reviewer. Up to five stages can be chained so, for example, the records owner reviews first and legal signs off last; an auto-approval window of 7 to 365 days keeps items from stalling. We configure the stages you decide, run the first cycle with your reviewers, and leave them able to run every cycle after.

When a record is disposed of through review, Purview keeps an entry in the disposed-items record — what it was, where it lived, who approved disposal, when, and any comment — for up to seven years, and the entries can be exported from the portal or, for large sets, by PowerShell. Alongside it, Purview Audit records who applied, changed or removed a label and who approved each disposition. We perform both exports with your team during the engagement and write the steps into the runbook, so an auditor's 'show me what you destroyed last year and who authorised it' is answered with a file, not a meeting.

Per Microsoft's licensing guidance at the time of writing, records and regulatory records, event-based retention, disposition review, auto-apply with trainable classifiers and adaptive scopes are covered by Microsoft 365 E5 (and A5/G5), Office 365 E5, the E5 Compliance add-on and the E5 Information Protection and Governance add-on; the Microsoft Purview Suite brings the compliance set to Business Premium and E3 tenants. Microsoft 365 E3 and Business Premium on their own give you retention policies and manual labels but not the records features. Week one verifies precisely what your subscriptions include and names any gap; buying a plan is your decision, and we will not recommend one your current licensing already covers.

Copilot answers from what your tenant keeps and what the user can reach. A records program settles the first half — what is retained, for how long, and what is disposed of on schedule — so Copilot is not confidently summarizing a superseded contract or a personnel file that should have been destroyed years ago. It does not settle the second half: who can reach what. That is permissions and sensitivity labelling, and it is the subject of Microsoft Purview Data Governance for Microsoft 365 Copilot. Organizations preparing for Copilot usually need both, in that order or the reverse depending on where the greater risk sits.

Not by us, and not silently. Labels are published and auto-apply rules are piloted in ways that declare and retain; nothing is deleted until a retention period ends, and for any class with a disposition review nothing is deleted until your reviewers approve it. The first disposition cycle we run in week three is on items your reviewers judge, and every decision is theirs. If your schedule contains classes whose period has already expired for existing content, we show you what a review would present before any label that could trigger disposal is published.

Three weeks: schedule to file plan, build and pilot, disposition and handover. The fixed price covers one tenant and one file plan of up to about 25 record classes, licensing verification, the labels and scopes, auto-apply and event types, disposition review setup and a first cycle, the proof-of-disposition and audit procedures, the pilot, the one-page records policy statement, the runbook and the handover session — quoted in writing before work begins and, per our standard terms, paid after you approve delivery. Larger schedules, several entities, historical backfill and event integrations are priced in the quote, not discovered mid-project. Microsoft licensing is always separate.

It can be, with two honest caveats. Business Premium alone does not include the records features — you would add the Microsoft Purview Suite or an E5-level plan for the users in scope, and the licensing verification in week one is exactly where we confirm the cheapest route. And a records program is only worth building if someone will own it afterwards: run the reviews, keep the file plan current, raise the events. Where a small organization mainly needs to stop hoarding and delete on schedule, we will say that Data Lifecycle Management is the better first spend.

Yes, as a separately quoted piece of work once the program is live. Purview exposes event types and events through the Microsoft Graph records management API, so an employee's departure recorded in your HR system, or a contract's end date in your contract repository, can raise the retention event with the right asset ID without anyone opening the Purview portal. In this engagement we define the event types, fix the asset-ID convention and design the integration path; the flow or script itself is built afterwards so it is written against a file plan that has already settled.

Purview compliance roles for records management and disposition, plus SharePoint, Exchange and Teams administration where publishing labels needs it, granted for the three weeks and removed at handover. For organizations that buy their Microsoft licensing through IT Partner we normally work through the least-privilege delegated access already in place; otherwise a temporary role you grant and we ask you to revoke. We do not need, and do not ask for, standing global administrator rights — and enabling regulatory records is a single PowerShell command run only after your signed go/no-go.