Data Protection Centre/Microsoft 365/Admin's Guide To Exchange Online Retention Policies, MRM & Holds

Categories

In this article

  • Introduction
  • What happens when you delete Exchange Online data?
  • Why do you need retention?
  • Data retention in Exchange Online
  • Messaging Records Management (MRM)
  • Retention policies and Retention labels
  • Archive mailboxes
  • Litigation holds
  • eDiscovery holds
  • Third-party backup solutions

Admin's Guide To Exchange Online Retention Policies, MRM & Holds

16 Apr 2025
20 min read
Ragavarshini

Exchange Online retention at a glance

Exchange Online retention policies and Messaging Records Management (MRM) help manage the email data lifecycle.
  • Policies can be applied to mailboxes to retain or delete data according to organizational needs.

  • Advanced features like holds are available with higher-tier licenses but lack automated recovery.

Read more

1. Introduction

Does your company have an active Exchange Online retention strategy in place for Microsoft 365?

Given the fact that Microsoft is not responsible for backing up your data, it is the sole responsibility of IT administrators to make sure retention policies are in place to overcome data loss events and ensure legal compliance.

In this article, we will do a deep dive into the various data retention strategies for Exchange Online, including steps on how to configure them and tips on when to use what.

Note: Microsoft does not back up your Exchange Online data. Native retention is for compliance and lifecycle management, not data recovery.

Use the diagram below to navigate to a specific section.

flowchart

1.2. Data Architecture

Exchange Online works behind the scenes to store data for both Outlook and Teams, the two main communication tools in Microsoft 365.
Exchange Online is a Microsoft service that provides an integrated system for email, calendaring, messaging, and tasks. A number of Microsoft 365 cloud applications are included in Exchange Online - ToDo, MyAnalytics, Outlook, Contacts, and Calendar. In addition, Teams data such as chats, and call summaries are also stored in Exchange Online. Exchange Online, therefore, serves as a data repository for two “wrapper” applications - Teams and Outlook.

2. What happens when you delete Exchange Online data?

The diagram below shows the default data retention procedure in Exchange Online and how data can be restored by users and administrators within specific timeframes.
swimlane diagram
When a user deletes a mailbox item (from any folder other than the Deleted Items folder), it goes to the Deleted Items folder (or the first recycle bin). Here, it stays for 30 days within which a user can restore the item back to its original location.
If the item is deleted from the Deleted Items folder, or the 30-day period is over, it moves to the Recoverable Items folder. However, a user can also choose to soft delete an item (Shift+Delete) in any folder, which bypasses the Deleted Items folder and moves the item directly to the Recoverable Items folder.
The item stays in the Recoverable Items folder for 14 days by default, within which the user or the admin can choose to recover it back to its original location. This time period can be extended from 14 days up to 30 days by the administrator. Beyond that, the item is permanently deleted and cannot be retrieved unless a retention policy or legal hold is created.

3. Why do you need retention?

  • Regulatory compliance: Regulated industries such as healthcare, legal, and finance are required to retain data such as emails or documents for multiple years. The Sarbanes-Oxley Act, for example, specifies the standards for financial document record-keeping.

  • Storage optimization: The mailbox storage limit for Exchange Online is 50 GB per mailbox in the Business Basic, Standard, and E1 subscriptions, and 100 GB per mailbox in the E3 and E5 subscriptions. Employees should not be forced to delete data once the storage limits are reached and at the same time, remove data that’s no longer needed. Implementing retention policies can thus save storage costs by only retaining essential data.

  • Data retrieval in case of accidental deletion:

    When an item is deleted, Outlook only retains your data for 30 days after deletion (check out this illustration to know more). Using retention helps you manage data deletion and recovery efficiently, thus increasing business productivity.

4. Data retention in Exchange Online

When users delete emails or other mailbox items in Exchange Online, those items don't disappear right away after 44 days if a retention policy or legal hold is created. When retention settings are applied to Exchange Online data, a timer job periodically evaluates items in the Recoverable Items folder. If an item doesn't match the rules of at least one retention policy or label to retain the item, it is permanently deleted (also called hard deleted) from the Recoverable Items folder. For more information on how the Recoverable Items folder retains different versions of the data, click here.

The sole purpose of the Recoverable Items folder is to quickly recover deleted items within a short period of time. It does not serve as a long-term effective retention strategy. Moreover, once the Recoverable Items folder reaches the storage quota, it cannot store any more items.

To enhance your data retention strategy, Microsoft provides two native Exchange Online retention mechanisms:
1)     Messaging records management (MRM)
2)     Retention policies and retention labels
In addition, administrators can use litigation hold to preserve data.
  • Archiving, eDiscovery Holds and third party backup solutions can also be configured for extended data retention.
Here is a comprehensive flowchart of all data retention methods in Exchange Online:
exchange online retention policy archiving holds

4.1. Messaging Records Management (MRM)

4.1.1. What is Messaging Records Management?

Messaging Records Management (MRM) in Exchange Online allows organizations to manage email lifecycle policies using retention tags and policies. While Microsoft now recommends using Purview retention labels and policies for most use cases, MRM remains useful, especially for archiving scenarios and for organizations that already rely on legacy configurations.

Note: Microsoft now recommends using retention labels and policies instead of MRM. MRM can also be used side-by-side with retention policies and labels. The following section is relevant for businesses that are currently using MRM, as well as organizations that require moving messages to the archive.

4.1.2. How MRM works

4.1.2.1. Retention tags and retention policies

MRM in Exchange Online works using retention tags and retention policies. Administrators can group retention tags into a retention policy, and then apply the policy to a user’s mailbox.
Retention tags are used to apply retention settings to folders and individual items. These settings define the time period for which a message remains in a mailbox, and the action to be taken after the message reaches the specified retention age. When a message reaches its retention age, it is either deleted or moved to the user's archive.
Retention tags can be linked to or unlinked from a retention policy at any time, and the changes automatically take effect for all mailboxes that have the policy applied.

Note: You can only apply one retention policy to a mailbox.

There are three different types of retention tags available: Default Policy Tag, Retention Policy Tag, and Personal Tag.

Default Policy Tag (DPT)Retention Policy Tag (RPT)Personal Tag

Description

Applies to untagged mailbox items, i.e., those that don't have a retention tag, directly or by inheritance from the folder.

Applies to default folders such as Inbox, Deleted Items, Sent Items, and so on, that are automatically created in a mailbox.

Users can automate tagging by using Inbox rules to either move a message to a folder that has a particular tag or to apply a personal tag to the message.

Where is it applied

Automatically applied to the entire mailbox
Automatically applied to a default folder
Manually applied to items and folders

Who applies it

Administrator
Administrator
User

Show more

 

To learn more about the different retention tags, click here.

4.1.2.2. Actions involved when you deploy MRM

When creating retention tags, there are three actions you can choose from that will take place when the retention period is over. The actions are:

Delete and allow recovery:

This is similar to what happens when a user empties the Deleted Items folder. The items move to the Recoverable Items folder and stay there till the retention period has passed.

Move items to an archive automatically:

This moves the message to the user’s archive mailbox after the retention age is reached. However, no action will be taken if the archive mailbox has not been enabled. This action is only available for Default Policy Tags and Personal Tags.

Permanently delete:

If you choose this action, the message will be permanently deleted after the retention period. The only way this data can be found again is if it is placed on litigation hold.

4.1.3. How to deploy MRM?

As of 2025, MRM settings are now managed through the Microsoft Purview portal, specifically under the Exchange (legacy) section in Data Lifecycle Management.

There are three steps you need to follow to deploy MRM:

  • Step 1: Create a retention tag

Sign in to the Microsoft Purview portal and navigate to Data Lifecycle Management from the left-hand navigation panel. Under the Exchange (legacy) section, click on MRM Retention tags to view or create tags.

Give a name and description for your retention tag.

When prompted, choose the type of retention tag you want to create, a Default Policy Tag (DPT), a Retention Policy Tag (RPT), or a Personal Tag, depending on how you want the tag to be applied.

Define the retention settings to determine what action is taken after a specified period of time and finally review the tab and press "Submit".

  • Step 2: Configure the retention policy

After creating your retention tags, navigate to MRM Retention policies under the Exchange (legacy) section in the Data Lifecycle Management area of the Microsoft Purview portal. Click on the "New Policy" and name your policy.

Configure you policy by adding the retention tags you want to include in this policy

Review and submit the policy to activate the policy.

  • Step 3: Assign the retention policy to mailboxes

Open the Exchange Admin Center and sign in with your administrator credentials. From the left navigation pane, go to "Recipients" and click on "Mailboxes", then select the user you want to assign the policy to.

Click "Mailbox">"Manage mailbox policies" and you will find the dropdown to select the Retention policy for the desired user. Select the policy you want to assign and press "Save".

To learn about personal tags and how users can self-assign these tags, click here.

4.1.4. Managed Folder Assistant

In MRM, the Managed Folder Assistant (MFA) is a throttle-based assistant that is responsible for processing the policies applied on the user mailboxes. In other words, the MFA inspects the mailbox items for retention policies, and when a policy is detected, it stamps the item with appropriate retention tags. It then takes the specified retention action on items once they are past their retention age.
The MFA does not need to be scheduled or maintained; it is always active. Another thing to note is that at a specified interval (known as the work cycle checkpoint), the MFA refreshes the list of mailboxes to be processed. During the refresh, the MFA checks for newly created or moved mailboxes, and subsequently adds them to the queue. It also inspects mailboxes that haven’t been processed due to failures and adds them higher up in the priority queue.

Click here to learn more about MFA.

4.1.5. What retention policy has priority?

What happens when there are multiple retention tags applied on a single mailbox item? Microsoft has clearly outlined the priority of the MRM tags to determine which action will be implemented.

Retention tag priority
When an item is tagged manually using a Personal Tag (PT), it takes the highest priority.
Next, the Retention Policy Tag (RPT) is executed, where the item sits in the folder in which the tag is applied.
Finally, general mailbox policies through a Default Policy Tag will be applied if none of the other two methods had been used to implement the retention policy.

4.1.6. Default MRM policy

The Default MRM policy is automatically applied when a new mailbox is created in Exchange Online. You can change the retention policy applied to a user at any point in time.
Tags included in the Default MRM Policy can be modified according to your business needs. You can change the retention age or retention actions, disable a tag, or modify the policy by adding or removing tags from it. The updated policy is applied to mailboxes the next time they are processed by the MFA.
The Default MRM Policy contains the following retention tags
●       1 Month Delete
●       1 Week Delete
●       1 Year Delete
●       5 Year Delete
●       6 Month Delete
●       Default 2 year move to archive
●       Junk Email
●       Never Delete
●       Personal 1 year move to archive
●       Personal 5 year move to archive
●       Personal never move to archive
●       Recoverable Items 14 days move to archive

Click here to learn more about the Default Retention Policy in Exchange Online.

4.1.7. Is MRM your best possible retention solution for Exchange Online?

As mentioned above, Microsoft recommends using retention policies and labels over MRM. However, mailbox archiving is only available in MRM.
Microsoft suggests using MRM for your archiving requirements, and retention policies for your retention needs.
Pro tip

Neither MRM nor retention policies and labels serve as data backup solutions. Microsoft recommends using third-party backup tools for your backup requirements.

4.1.8. Retention holds in MRM

A retention hold helps you temporarily suspend the MRM retention policies applied to a user’s mailbox. This is useful when an employee is temporarily away such as on a vacation.
For example, let’s say that an employee goes on a three-month leave. The organization has implemented a policy where items are moved to the archive after one month and then deleted after fifteen days. That means that by the time the employee returns after three months, many days of emails will be unavailable and permanently deleted.
Retention holds are designed for this purpose. It suspends the processing of an MRM retention policy by the MFA for that mailbox for a period of time. Apart from temporarily suspending the retention policies, retention holds also allow you to set a retention comment, so everyone knows that the mailbox is on hold.

To learn more about how to create retention holds, click here.

4.2. Retention policies and retention label

Microsoft 365 retention policies and labels are effective in retaining data in your organization. Both retention policies and retention labels can either be used separately or in a combination, according to the type of data and your business requirements. Before understanding how to create retention policies and labels, it is essential that we understand the key differences between the two, and when to use what.

4.2.1. Retention policies vs. retention labels: Which one should you choose?

Retention policies are used to assign settings at a container level, i.e., at a mailbox level. Retention labels, on the other hand, are used for specific mailbox items such as a particular folder or email.
For example, if you want the entire mailbox of a user retained for five years, it is easier to apply a retention policy on the entire mailbox rather than multiple retention labels on each mail. However, if you want to pick and retain certain mails for five years and some others for three years, you should use retention labels.
Another notable difference is that, unlike retention labels, retention policies are bound to content containers and apply only to the content within. In other words, retention labels apply to the content even after the location is moved, while retention policies apply only to the location in which it is assigned.

Microsoft has put together a comprehensive table explaining different scenarios to help you identify when to use what.

To learn more about how to create and apply retention policies and retention labels, read this article.

4.2.2. What data is included under Microsoft 365 retention policies and labels?

Though Exchange Online acts as a data storage center for multiple apps, the Microsoft 365 retention policies and labels are applicable only to certain data.

IncludedNot included
  • Mail messages (includes received messages, drafts, sent messages) along with any attachments
  • Tasks with an end date.
  • Notes
  • Calendar items that have an end date are supported for retention policies but aren't supported for retention labels
  • Calendar items that have an end date are supported for retention policies but aren't supported for retention labels
  • Contacts, and any tasks and calendar items that don't have an end date

4.2.3. Limitations of using retention policies and labels

It is a common misconception that the retention features offered by Microsoft are enough to safeguard your data. If you plan to use retention labels and policies for your business, here are some limitations you should be aware of.

  • Retention features are part of the Purview portal which is only available in the advanced E3 and E5 subscriptions of Microsoft 365. These plans are priced higher than the standard Microsoft 365 plans.

  • Calendar items and tasks with no end date are not retained under retention policies and labels.

  • A maximum of 10,000 policies can be included in a tenant. This includes all the different policies available, including DLP policies.

  •  The maximum number of retention policies for Exchange Online (per workload) is 1800.

  • Since retention policies and labels can be configured to scope your retention settings to specific users, specific Microsoft 365 Groups, or specific sites, you need to be aware of the maximum number of items per retention policy:
    • 1,000 mailboxes (user mailboxes or group mailboxes)
    • 1,000 Microsoft 365 Groups

4.2.4. What happens when an item under retention policy is deleted before the retention period - Principles of retention

Most organizations have multiple retention policies applied to different content on a daily basis. There are also possibilities of the same content being subject to different retention policies.
Here is a comprehensive flowchart by Microsoft, to help you determine what policies take precedence over others without worrying about one policy setting overwriting the others.

principles of retention

4.3. Other methods of retaining data

4.3.1. Archive mailboxes

In Microsoft 365, archive mailboxes provide users with additional mailbox storage space beyond the standard quota assigned to their primary mailbox. These mailboxes are useful for storing older or infrequently accessed emails and are especially important for organizations with long-term retention or compliance needs.
To begin using archive mailboxes, an administrator must enable the archive feature for each user. Once enabled, users receive an initial archive quota of 100 GB.
When this 100 GB limit is reached, auto-expanding archiving automatically allocates additional archive space in 50 GB increments. This eliminates the need to contact Microsoft for archive extensions.

Important Update: Microsoft now enforces a soft limit of 1.5 TB for auto-expanding archives. Although it was previously marketed as “unlimited,” mailbox growth beyond this point is no longer supported. This limit applies per archive mailbox and includes all content moved there through retention policies, user rules, or manual actions.

For step-by-step instructions on how to turn on auto-expanding archiving, click here.

To understand unlimited archiving in detail, click here.


Pro tip

Archiving has multiple limitations including storage limits. Third-party solutions such as SysCloud provide unlimited storage in the backup archives, in addition to hassle-free backup and restore capabilities.

4.3.1.1. Can you use the archiving feature as a retention method for Exchange Online?


Though archive mailbox helps retain important mailbox items, it is not a reliable long-term solution. Here are a few limitations:

  • The archive mailbox has a storage limit of 100 GB, after which auto-expanding archives must be used. Auto-expanding archives are only supported in the Microsoft 365 E3 and E5 subscriptions.

  • Microsoft now has a storage limit of 1.5 TB for auto-expanding archives.

  • Expanded archiving cannot be enabled using the admin centers. Administrators must use PowerShell to enable the feature.

  • Auto-expanding archive is only supported for mailboxes with a growth rate that does not exceed 1 GB per day. This applies to both user and shared mailboxes.

  • The auto-expanding feature prevents you from recovering or restoring an inactive mailbox. Click here to know more.

  • You can't delete a folder from the archive mailbox after an auto-expanded storage area has been provisioned.

  • If an item is deleted from the auto-expanded storage area, it is lost forever. There is no way to retrieve it.

4.3.2. Litigation holds

Litigation Hold helps you place user mailboxes on hold, i.e., retain all the contents of a mailbox, including deleted items and the original versions of modified items. It is a functionality of the eDiscovery feature in Exchange Online that is helpful in freezing crucial data. When a mailbox is placed on litigation hold, Items in the user's primary and the archive mailboxes (if enabled) are retained.
When you create a litigation hold, you can specify the time duration for which you want the items retained, after which they will be deleted. You can also just place an infinite hold on the mailbox, wherein the content will be retained indefinitely unless you remove the hold.

5.3.2.1. Litigation holds vs. retention policies

While both litigation holds and retention policies perform similar functions, their usage and feature sets are different. It is essential for administrators to be aware of when to use what. Here is a comprehensive table we have put together for your understanding:

Retention policiesLitigation holds
Retention policies are used to protect valuable data from data loss such as accidental deletion.
Litigation hold is a functionality of the eDiscovery feature that is helpful in preserving data for legal compliance.
Retention policies can be automated for new users.
Litigation holds have to be manually applied to every new user.
Retention policies allow you to set time limits on data preservation, after which specific actions will be implemented.
Time-based holds must be turned on and off manually, after which no automatic actions will be implemented.

Show more

 

To get a complete understanding of why holds are different from retention policies and labels, check out this article.

4.3.2.2. Does litigation hold qualify as a backup solution?

The purpose of a litigation hold is to preserve data for long-term purposes such as legal compliance. However, due to its retention capabilities, litigation hold is often misunderstood as a backup solution. There are significant limitations in using litigation hold as a backup solution.

  • Cross-user restore is not available. In other words, if an employee quits, litigation hold doesn’t allow you to transfer the data to another user. Moreover, litigation hold let you remove users while preserving their data forcing you to continue paying for Microsoft licenses for inactive users.

Pro tip

SysCloud’s cross-user restore feature helps admins easily transfer data from one user to another, thereby saving license costs for employees who may have left the organization.

  • Data that is on litigation hold cannot be deleted. As a result, your storage requirements and costs increase exponentially over time.

  • If the contents of a user’s mailbox are affected by ransomware, the data stored in litigation hold also gets infected. There is no guarantee that you will get your data back.

Pro tip

SysCloud automatically inspects your backup archives for ransomware and phishing and immediately notifies the administrator.

  • Litigation hold is only available in the E5 edition of Microsoft 365.

4.3.3. eDiscovery holds

eDiscovery (Standard) is a basic eDiscovery tool that organizations can use to search and export content in Microsoft 365. However, it can also be used to place holds on content locations such as Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams.

To learn more about eDiscovery Holds, and how it does not serve as a backup solution, check out this article.

4.3.4. Third-party backup solutions

While the native settings offered by Microsoft are helpful in retaining your data, they do not serve as a backup solution. Microsoft is not responsible for backing up your data and they recommend using third-party apps for backup. Don’t take our word for it; here is an extract from their Services Agreement (Section 6.b).


WE STRIVE TO KEEP THE SERVICES UP AND RUNNING; HOWEVER, ALL ONLINE SERVICES SUFFER OCCASIONAL DISRUPTIONS AND OUTAGES, AND MICROSOFT IS NOT LIABLE FOR ANY DISRUPTION OR LOSS YOU MAY SUFFER AS A RESULT. IN THE EVENT OF AN OUTAGE, YOU MAY NOT BE ABLE TO RETRIEVE YOUR CONTENT OR DATA THAT YOU’VE STORED. WE RECOMMEND THAT YOU REGULARLY BACKUP YOUR CONTENT AND DATA THAT YOU STORE ON THE SERVICES OR STORE USING THIRD-PARTY APPS AND SERVICES.


Here is a comprehensive list of why having a third-party backup solution is an absolute necessity.

  • Limitations of native retention settings: The native retention settings offered by Microsoft do not serve as an effective data backup and recovery option . Having an independent backup of your data stored off-site is an effective bulwark against data loss incidents.

  • Easy restoration: Third party tools such as SysCloud, help you easily restore specific or all emails in just a few clicks.

  • Save license costs: Third-party solutions allow you to retain safe copies of organizational data even after employee exits and account deletions, thus saving license costs.

  • With simple GUIs, no technical or coding expertise is required to backup and restore data.

  • Fast backups: Take faster backup even for large teams.

  • Protection against ransomware and phishing: Cloud security concerns have sky-rocketed in the pandemic. Tools like SysCloud secures data being backed up from ransomware and phishing.

4.3.4.2. SysCloud vs. native Exchange Online retention

FeaturesSysCloudNative microsoft retention methods

Outlook

Export mailbox as PST

Export mailbox as MBOX

Export email as EML

Show more

 
Explore SysCloud's Exchange Online Backup Solution

Secure, automate, and restore your Exchange Online data effortlessly with SysCloud’s powerful backup solution.

Explore Now

Recommended content

Get actionable SaaS administration insights

We don’t spam. Unsubscribe anytime.

In this article

  • Introduction
  • What happens when you delete Exchange Online data?
  • Why do you need retention?
  • Data retention in Exchange Online
  • Messaging Records Management (MRM)
  • Retention policies and Retention labels
  • Archive mailboxes
  • Litigation holds
  • eDiscovery holds
  • Third-party backup solutions

Start enjoying faster and easier backups, today

Avoid costly data retention gaps and minimize time to recovery with SysCloud's cloud backup.Start 30-Day Free Trial
Certifications
Certifications