Retention Labels and Records

Quick Answer: Retention policies and retention labels in Microsoft Purview Data Lifecycle Management control how long content lives — including Copilot prompts and responses stored in the compliance substrate. Records Management adds immutability for regulatory records. Sensitivity labels control confidentiality, not retention duration.

Data Lifecycle Management in Purview

While Information Protection classifies how sensitive content is, Data Lifecycle Management defines how long content must be kept and when it must be deleted. AB-900 expects you to apply lifecycle thinking to AI-generated content and Copilot audit records, not only traditional email and SharePoint files.

Two primary tools:

Policies can retain only, delete only, or retain then delete after a period such as seven years.

Retention and Copilot Interaction Data

Microsoft 365 Copilot interaction data — prompts and responses captured in the compliance substrate and unified audit log — can be governed by Purview retention policies and labels. This ensures:

• Regulated industries meet minimum retention periods for AI communications.
• Data is disposed when no longer required, supporting data minimization.
• Lifecycle continues independent of user account status — if a nurse leaves the organization, Copilot logs may still be retained seven years for HIPAA audit even though the account is deleted.

Common Trap: Copilot interaction data is not automatically deleted after 180 days. The 180-day figure applies to Audit (Standard) log retention — organizational retention policies may require longer preservation and override default log expiry when properly configured.

Retention Labels and Disposition Review

Retention labels offer finer control than location policies:

• Event-based retention — clock starts when an event occurs (employee termination, contract end).
• Disposition review — when retention expires, a reviewer must approve deletion.
• Auto-apply labels — classify items matching keywords or sensitive info types.

For Copilot governance, auto-applied retention labels can tag AI interaction records in eDiscovery or audit exports, ensuring they follow the same HR investigation retention schedule as related Teams messages.

Records Management

Microsoft Purview Records Management is the regulatory-grade layer for formal records:

• Declares documents as regulatory records with immutable status.
• Blocks users from editing or deleting declared records.
• Requires disposition reviewers authorized to approve destruction at end of life.
• Supports file plan imports for agencies with formal taxonomy codes.

Records Management detects regulatory violations in communications — no, that is Communication Compliance. Records Management governs retention and disposition of declared records — a frequent AB-900 distinction.

Records vs Retention Labels

eDiscovery and Legal Hold

Microsoft Purview eDiscovery (Standard and Premium) searches and exports content for legal investigations. For Copilot:

• eDiscovery can search and export Copilot prompts and responses stored in compliance infrastructure.
• Legal hold preserves content regardless of retention deletion schedules.
• eDiscovery does not proactively detect harassment — it supports litigation after a matter is opened.

Pair eDiscovery with retention: a hold suspends disposition while investigations proceed.

Sensitivity Labels vs Retention Labels

Assigning a sensitivity label does not set retention duration. Assigning a retention label does not encrypt content. AB-900 scenario questions often swap these effects.

Compliance Manager (Supporting Tool)

Microsoft Purview Compliance Manager provides a compliance score and prioritized recommended actions mapped to frameworks (GDPR, ISO 27001, NIST). It helps organizations identify gaps in Copilot readiness — it does not auto-configure all settings or monitor individual Copilot responses in real time.

Worked Scenario: Seven-Year Retention

A government contractor must retain all project communications — including Copilot drafts in Word and Teams Copilot chats — for seven years, then delete. The administrator should:

1. Create a retention label: retain seven years, then delete with disposition review.
2. Auto-apply the label to content in project SharePoint sites and Teams channels.
3. Configure retention on Copilot interaction records in the substrate for the same period.
4. Use eDiscovery holds if litigation pauses deletion.
5. Not rely on sensitivity labels alone — they do not enforce seven-year retention.

Choosing Audit Standard alone is insufficient if project policy exceeds 180-day log retention without supplemental export or Premium audit.

Administrators should document which retention policies cover Copilot Chat, Teams Copilot, and app-embedded Copilot experiences so investigators know where to search during HR or regulatory cases. Consistent labeling across channels prevents gaps where one Copilot surface retains data while another disposes it prematurely.

Data Minimization and AI Exposure

Retention supports data minimization for Copilot: shorter retention on low-value chat reduces how much historical content exists for semantic indexing. Balance legal minimums against AI exposure — legal counsel defines the floor; administrators implement in Purview.

Study Checklist

• Contrast retention policies vs retention labels.
• Explain how retention applies to Copilot interaction data.
• State whether retention continues after user account deletion (yes, when policy requires).
• Distinguish Records Management from Communication Compliance.
• Separate sensitivity labels (confidentiality) from retention labels (lifecycle).