An email retention policy is a documented set of rules that decides how long a company keeps email, what gets deleted, and what gets archived. The single most important move for administrators: use retention policies and labels for everyday lifecycle management, and reserve litigation holds strictly for legal preservation. Regulatory drivers like the FRCP, SEC, and IRS shape how long specific records must stick around, and getting that mapping wrong is where most companies get into trouble.
TL;DR:
- Most organizations mistakenly use litigation holds as a regular retention method, causing unnecessary storage growth and compliance issues.
- Retention policies apply at the mailbox or site level, while labels provide finer control for individual messages, with holds overriding these settings during legal cases.
- Retention periods are driven by industry regulations such as the SEC, IRS, and Sarbanes-Oxley, and must be tailored through legal consultation to avoid compliance gaps.
- Building an effective policy requires mapping email data sources, classifying content, and documenting exception processes before configuration.
- Proper implementation includes clear ownership, staff training, ongoing monitoring, and adjusting policies to reflect changing regulations and organizational needs.
Table of Contents
- What counts as email under a retention policy
- Retention policies, retention labels, and litigation holds explained
- Legal and regulatory drivers behind retention periods
- Building an email retention policy step by step
- Setting up retention the right way in Microsoft 365
- Who owns the policy after it's written
- Managing litigation holds and special exceptions
- A quick-reference checklist and sample schedule
- What we see go wrong in small business retention setups
- Getting your retention policy actually implemented
- Where to go for deeper technical and legal detail
- Sources
- FAQ
What counts as email under a retention policy
Before writing a single rule, decide what the policy actually covers. That means naming every mailbox type it touches: user mailboxes, shared mailboxes, and organizational or role-based mailboxes all need coverage, even if the retention periods differ.
Message types matter too. A modern policy has to account for attachments, calendar items, and Teams messages that get stored in Exchange, not just plain text emails sitting in an inbox. Skipping these creates blind spots that show up during an audit or a legal request.
Retention rules generally fall into three actions:
- Retain-only: keeps content for a set period without deleting it automatically.
- Delete-only: removes content after a set period with no retention requirement.
- Retain-then-delete: keeps content for the required window, then deletes it automatically.
A written policy document should spell out its purpose, its scope (which mailboxes and content types it applies to), who owns enforcement, the retention periods for each content category, and the process for placing a legal hold when needed. Without that documentation, the policy is just a set of settings nobody can defend later.
Retention policies, retention labels, and litigation holds explained
These three tools solve different problems, and mixing them up is one of the most common mistakes administrators make.
Retention policies work at the container level: they apply to an entire mailbox or site and are best for broad, organization-wide rules like "delete everything after seven years." Retention labels work at the item level, letting you tag individual emails or documents with specific rules that override the container policy when needed. According to Microsoft's Purview retention documentation, retention policies can automate deletion at scale, while labels handle exceptions and special cases that need finer control.
Litigation holds and eDiscovery holds are a different animal entirely. They preserve data for legal matters and have no configurable expiration, and they override any deletion rule set by a policy or label. Microsoft's guidance is direct on this point: many organizations mistakenly use eDiscovery holds for everyday lifecycle retention, which needlessly balloons storage and complicates compliance instead of simplifying it.
There are administrative limits to plan around too. In Exchange, a mailbox can carry only one retention policy at a time, though that policy can bundle multiple retention tags to handle different content types, according to Microsoft's Exchange Server documentation. When a hold and a retention policy point in different directions, the hold wins every time.
Legal and regulatory drivers behind retention periods
Retention periods rarely come from guesswork. They come from specific legal obligations that vary by industry, and getting them wrong carries real financial and legal risk.
The Federal Rules of Civil Procedure, Rule 34, establishes that parties must preserve and produce electronically stored information, including email, in a reasonably usable form once litigation is reasonably anticipated. That duty to preserve kicks in independent of any retention schedule, and automated deletion is never a defense if relevant email gets destroyed after that duty arises. This is exactly why litigation holds exist as a separate control from routine retention settings.
Regulated industries face additional layers. Broker-dealers fall under SEC Rule 17a-4, which requires electronic records to be retained under a WORM (write once, read many) model or an approved audit-trail alternative. The SEC's staff guidance walks through the technical expectations and compliance dates firms need to follow.
Other frameworks shape common retention windows across industries. Sarbanes-Oxley influences financial recordkeeping, and the IRS applies its own Capstone-style approach to email records, sometimes retaining organizational mailboxes for extended periods depending on role, according to the IRS Internal Revenue Manual. Government agencies often follow NARA's Capstone model for permanent records, with transfer timelines built around role designations rather than mailbox-by-mailbox review.
None of this replaces a conversation with legal counsel. Industry-specific obligations shift often enough that a policy built on last year's assumptions can quietly fall out of compliance.
Building an email retention policy step by step
A defensible policy follows a sequence, not a checklist assembled after the fact. Skipping steps here is how companies end up with rules that look good on paper but fail the first time they're tested.
- Inventory your mail systems and map where email data lives, including shared mailboxes, archives, and any third-party email tools still in use.
- Classify content into records, non-records, and transitory messages, then assign a retention period to each category based on business need and legal requirement.
- Choose your mechanism, deciding whether a container-level retention policy or an item-level label fits each category, along with the trigger that starts the retention clock and the disposal action at the end.
- Document exceptions and the holds process, spelling out who can request a hold, how it gets logged, and how it gets released.
- Set an approval and review schedule, so the policy gets signed off by legal and IT leadership and revisited on a fixed interval, not left to drift.
This sequence matters because retention decisions made in isolation, without mapping the full data flow first, tend to miss entire categories of email until an audit or legal request exposes the gap. A policy built in this order holds up under scrutiny because every retention period traces back to a documented reason.
Setting up retention the right way in Microsoft 365
Microsoft 365 gives administrators two main levers: retention policies for broad, container-level rules, and retention labels for item-level exceptions. The general pattern that works for most organizations is a conservative, org-wide policy (commonly a multi-year window) paired with scoped labels for roles or departments that need different treatment.
Precedence rules matter here. Retain generally wins over delete when settings conflict, and content under an active hold moves into what Microsoft calls Preservation Hold status, meaning it stays recoverable even if a user deletes it. That's a meaningful safety net, but it also means holds can quietly accumulate storage if nobody's tracking them.
Platform limits are worth planning around before you hit them. Microsoft's retention limits documentation lays out maximum policy counts per tenant and per-workload thresholds, along with guidance on mailbox include and exclude lists. In Exchange specifically, the Managed Folder Assistant runs on its own cadence to apply tag actions like moving items to an archive or deleting them, so changes to a policy don't take effect instantly.
Auto-labeling and trainable classifiers can help apply labels at scale based on content patterns, which is useful for organizations with high email volume, but they come with their own storage and processing considerations that are worth testing on a small scope before rolling out tenant-wide.
Who owns the policy after it's written
A policy is only as good as the people enforcing it day to day. Assign clear ownership: a records manager or compliance lead sets the rules, mailbox owners follow them, and IT administrators handle the technical configuration and monitoring.
Training closes the gap between policy and practice. Staff need plain guidance on what counts as a business record worth keeping, what's safe to delete, and how to handle personal correspondence that lands in a business inbox.
Ongoing monitoring keeps the policy honest. Regular retention reports, coverage checks to confirm every mailbox falls under an active policy, and exception tracking for anything flagged outside normal rules all belong in a recurring review cycle. A few KPIs worth tracking:
- Policy compliance rate: the share of mailboxes correctly covered by an active retention policy.
- Storage reclaimed: how much mailbox space gets freed as retention rules take effect.
- Hold compliance: whether active legal holds are being honored without gaps.
Managing litigation holds and special exceptions
When litigation or an investigation arises, someone with clear authority, usually legal counsel or a designated compliance officer, needs to issue the hold and document its scope: which custodians, which mailboxes, and which date range it covers.
Holds override retention settings automatically. Content under a hold stays preserved even if a retention policy would otherwise delete it, and that precedence never flips the other way.
Releasing a hold needs its own paper trail: who authorized the release, when it happened, and confirmation that the underlying legal matter is resolved. Throughout the process, IT and legal need to stay in sync, since a hold placed without proper technical scoping can either miss relevant data or preserve far more than necessary.
A quick-reference checklist and sample schedule
Before finalizing a policy, confirm it covers: mailbox scope, content classification, retention periods by category, the mechanism used (policy or label), the disposal action, and a documented holds process.
A basic retention schedule looks something like this:
- Transitory messages (calendar invites, casual notes): 90 days.
- Routine business correspondence: 1 to 3 years.
- Tax and financial records: 7 years, aligning with common IRS and financial recordkeeping expectations.
- Permanent or archival records: retained indefinitely, often in a separate archive tier.
Non-records, like personal messages or duplicate copies, generally don't need formal retention at all. Shared mailboxes deserve their own line in the schedule since multiple people may rely on them, which makes ownership and review timing less obvious than with individual accounts. For a closer look at how retention layers work with backups specifically, backup retention policies cover that distinction in more depth.
What we see go wrong in small business retention setups
The most common mistake we see is treating litigation holds as a retention tool, which quietly inflates storage and creates confusion about what's actually protected versus what's just sitting there. A close second is a single retention policy applied tenant-wide with no exceptions for finance, HR, or leadership mailboxes that carry different obligations.
A role-based approach, similar to the Capstone model government agencies use, cuts through this by tying retention to job function instead of managing dozens of one-off exceptions. Many organizations have worked with a managed IT provider on infrastructure and compliance projects, and the pattern holds up: fewer, better-designed policies beat a pile of ad hoc rules every time.
, Dustin Collett
Getting your retention policy actually implemented
Writing the policy is half the job. Getting it configured correctly in Microsoft 365, monitored over time, and adjusted as regulations shift is where most in-house teams run out of bandwidth.
Our IT & Security Assessment starts with an inventory of your mail systems and data flows, then maps out classification and recommended retention settings specific to your business. From there, our Managed IT Services cover ongoing Microsoft 365 administration, monitoring, and policy enforcement, so retention stays correct instead of drifting six months after setup. Fixed per-user pricing means no surprise invoices when your policy needs a review.
Where to go for deeper technical and legal detail
For the legal foundation, read FRCP Rule 34 directly, along with the SEC's Rule 17a-4 staff guidance if you're in financial services. On the technical side, Microsoft's Purview retention documentation and the IRS Internal Revenue Manual cover platform mechanics and government recordkeeping standards worth bookmarking. If retention as a broader business practice interests you beyond records compliance, this piece on covers a different but related use of the term.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- Learn about retention policies & labels to retain or delete | Microsoft Learn
- Federal Rules of Civil Procedure, Rule 34 (Production of Documents, Electronically Stored Information, and Tangible Things)
- Rule amendments for broker-dealers, SEC staff guidance (FAQ)
- IRS IRM, Standards for Managing Electronic Mail Records
FAQ
How long do emails need to be retained?
Retention length depends entirely on the content and the regulatory framework that applies: tax and financial records commonly fall under a 7-year window, while transitory messages might only need 90 days. There's no universal number, which is why classification comes before any retention period gets assigned.
What is the 12 second rule for emails?
This isn't a recognized legal or industry retention standard, and no authoritative source defines an informal advice on very short email retention periods for email retention. If you've seen it referenced elsewhere, treat it as informal advice rather than a compliance requirement.
What is the 7 year retention policy?
A 7-year retention window is a common choice for financial and tax-related records, often aligning with IRS recordkeeping expectations and similar regulatory windows. It's not a universal legal mandate for all email, so the actual requirement depends on the content type and your industry.
How do I set an email retention policy in Outlook?
Outlook itself doesn't set organization-wide retention. That configuration happens at the Microsoft 365 admin level through Purview retention policies and labels, which then apply automatically to user mailboxes without requiring individual Outlook settings.
Check your domain's email trust score
Free 60-second tool, see how your SPF, DKIM, and DMARC look to recipients.