Important Change to SharePoint Online Retention Policy Processing

Changes to Avoid Inadvertent SharePoint Data Loss

Office 365 Notification MC182494 (Figure 1) informs us about some important changes coming to the SharePoint Online Preservation Hold Library. The changes relate to Office 365 Roadmap item 52431 to address an issue where data loss can occur when a retention policy is removed from SharePoint sites.

Office 365 Retention Policies Keep Data Until They’re Removed

Office 365 retention policies put holds on data to stop information being removed. SharePoint stores modifications and deleted content in the Preservation Hold Library of sites within scope of retention policies. At the end of the retention period (for example, 5 years), content is moved to the first-stage recycle bin and stays there for the 93-day retention period. After this period elapses, the content is permanently removed and becomes irrecoverable.

The problem is that an administrator might inadvertently remove a retention policy from one or more sites. The hold on content in the Preservation Hold Library is removed and the content can be immediately purged by background processes because it’s likely that the files were originally deleted more than 93 days ago. Administrators can’t stop the purge happening, and if they don’t notice that the retention policy was removed, data loss can happen. In fact, even if someone does notice that the retention policy was removed and reapplies the policy, the time needed to reimplement the policy on affected sites could still leave a gap (from when the policy was removed) when data loss can occur.

New 30-Day Grace Period

To fix the problem, starting in August 2019, Microsoft will change what happens when a retention policy was removed from a site. The new behavior is that a 30-day grace period starts when a retention policy is removed from a site to stop the release of the hold on the site. During the grace period, any item in the Preservation Hold Library is kept because the hold is still in place. Once the 30-day grace period elapses, the hold is released, and SharePoint goes ahead and deletes the items. Another change now kicks in to put items deleted from the Preservation Hold Library into the second-stage recycle bin instead of being purged. Items stay in the second-stage recycle bin for up to 93 days after their deletion before they are permanently removed. During this time, items can be recovered by site administrators.

Need to Keep an Eye on Retention Policies

The combination of 30-day grace period before purges occur and the ability to recover purged content from the Preservation Hold Library and second-stage recycle bin before irrecoverable deletion gives administrator the ability to avoid data loss. That is, if someone notices that a retention policy has been removed from SharePoint. We all check retention policies and the locations that come within their scope on an ongoing basis, don’t we?