Data lifecycle management

Data lifecycle management is the broad term used to describe the retention, disposition, and deletion of content on the Microsoft 365 platform. With origination in Microsoft ExchangeMessage Records Management (MRM) policies and the SharePoint Records Center, modern data lifecycle management tools allow administrators to apply comprehensive data management policies across the entire breadth of the Microsoft 365 platform services.

You can access the data lifecycle management capabilities of Microsoft Purview by navigating to https://compliance.microsoft.com, expanding Data lifecycle management, and then selecting Microsoft 365, as shown in Figure 10.8:

Figure 10.8 – Data lifecycle management retention policies

For the MS-900 exam, you should be familiar with the core terminology of data lifecycle management:

• Adaptive scopes: These are configuration objects used to dynamically select users, SharePoint sites, or Microsoft 365 groups. For example, you might create an adaptive scope for the Sales organization users by creating a query for users with the Azure AD Department attribute configured with the value Sales.

• Static scopes: These configuration objects are used to select which workload and target objects are subject to a particular policy. If static inclusions or exclusions are configured as part of a policy, the only way the inclusions or exclusions can be updated is by manually editing or updating the policy.

• Locations: These are a combination of workload (such as Exchange Online) and target containers (such as individual mailboxes) or objects matching an adaptive scope.

• Retention policies: These are policy configuration objects that allow you to preserve and delete content based on criteria such as when content was created or last modified. Retention policies are targeted to scopes (either static or adaptive), applied to locations, and then have actions associated with them. Actions might include leaving content as is, scheduling a disposition review, or deleting content.

• Label: This is metadata that is used to categorize content. Common labels might include terms such as Confidential, Public, General, or Highly Confidential.

• Sublabel: This is a child item of a label that offers more specificity. For example, you may have a Confidential label with sublabels such as Customer information or Product specifications.
• Label policies: These are policy configuration objects that are used to publish labels to locations where users can apply them.

• Auto-labeling policies: These policies are used with classifiers to detect content automatically and apply a label.

• Protection settings: Depending on the type of object being configured, you may have options to configure policy settings. Common policy settings include applying or removing encryption, preventing content from being shared, or applying content markings such as headers, footers, and watermarks.

• Policy rules: These are lists of conditions for detecting content in auto-labeling policies.

• Policy mode: Depending on the type of policy, you may choose Enable, Run the policy in simulation mode (where it only logs actions that would be taken), or Leave policy turned off.
• Disposition review: A disposition review is an action that you can configure to occur at the end of a retention policy. Instead of automatically preserving or deleting content at the end of a retention policy period, you may wish to have the content evaluated by a content manager.

This content manager can determine whether the data is safe to delete, should be left alone, or should have another policy applied to it.

• File plan: This allows you to add additional data to labels, as well as to bulk import and export label information. File plans are useful for organizations with complex record management scenarios.
• Event-driven policies: In addition to policies that depend on when content was created, labeled, or modified, you can also create event-driven policies. Event-driven policies use initiated events as triggers for starting retention or labeling activities. For example, you may need to create a policy that retains data for 10 years after an employee leaves the organization. The retention period, in this case, starts with a particular business activity or event as opposed to being based simply on the age of the content.

When used together, these data governance features allow organizations to manage the entire lifecycle of how data exists inside a tenant. Next, you will explore Microsoft Priva.