13.2 Create and Manage Adaptive Policy Scopes

When you later create a retention policy or a retention label policy, you must choose adaptive or static for the policy scope. This section is where you create and manage the adaptive scopes themselves. You create the scope first; a later wizard will refuse to finish an adaptive policy if no scopes exist to select. You can attach one or more adaptive scopes to a single policy. Adaptive scopes are also used by communication compliance; this chapter focuses on how they work for retention.

Adaptive versus static

An adaptive scope is a query you define. Membership is not a frozen list. The query runs daily against the attributes or properties you chose for that scope type. New executives whose job title becomes Executive, new France users whose Country or region is France, or new communication sites that match a KeyQL filter enter the scope without you editing a policy.

A static scope does not use queries. Microsoft describes three static shapes: apply to all instances of a location (org-wide), include specific instances, or exclude specific instances. Static is simpler when you truly want every mailbox or every site, or when the include list is small and never changes. Static becomes expensive when people change departments, UPNs, or OneDrive URLs.

Microsoft's executive example makes the difference concrete. With adaptive, you query Job title = Executive and select Exchange email and OneDrive. You never paste SMTP addresses or OneDrive URLs. With static, you might include an executives group for Exchange (membership is expanded when the policy is created and is not kept in sync if the group later changes), and you must paste each OneDrive URL. OneDrive URLs are not created until the user first opens OneDrive (unless you pre-provision), and the URL changes if the UPN changes. Adaptive User scopes avoid that URL tax.

Adaptive policies are still subject to the maximum number of policies per tenant. Microsoft does not remove that tenant cap; it says flexible targeting usually means fewer policies. Do not invent a numeric tenant cap on the exam unless a current Learn page states it in the question's exhibit.

Warning if you remove the last static include: the location reverts to All. If that location was a delete policy, you can accidentally put every site or mailbox in scope. Toggle the location off instead of leaving an empty include list.

If you replace static policies with adaptive ones, leave the old policies in place, create new adaptive policies with the same retain/delete settings, validate targeting, then disable or delete the old policies.

The three scope types

The wizard asks which type of adaptive scope you want. The type controls both the attributes you can query and the locations a later policy can select. If you add only a User scope, you can select Exchange email but not SharePoint sites. If you need both mailboxes and sites, you add a User scope and a SharePoint sites scope (or a Groups scope for group-connected sites) to the same policy.

Users applies to Exchange mailboxes, OneDrive accounts, Teams chats and Copilot interactions, Teams private channel messages (pre-migration only), Viva Engage user messages, Team chats, Teams call logs, Microsoft Copilot experiences, Enterprise AI apps, and Other AI apps. Simple-builder attributes include first name, last name, display name, job title, department, office, street address, city, state or province, postal code, country or region, email addresses, alias, Exchange CustomAttribute1–15, and ExtensionCustomAttribute1–5. Those names map to filterable recipient properties (for example Alias maps to mailNickname / Email in Entra).

SharePoint sites applies to SharePoint sites and OneDrive accounts. Properties are Site URL, Site name, and custom refinable strings RefinableString00–99. Records Center sites (legacy) are not supported. With adaptive scopes the SharePoint location can include OneDrive and Microsoft 365 group-connected sites as well as communication, classic, and non-group team sites. Static SharePoint is named SharePoint classic and communication sites and does not cover group-connected team sites—those need Microsoft 365 Group mailboxes & sites.

Microsoft 365 Groups applies to Microsoft 365 Group mailboxes and sites, Teams channel messages (standard, shared, and private post-migration), and Viva Engage community messages. Attributes include name, display name, description, email addresses, alias, and the same Exchange custom attributes as users.

Administrative units from Microsoft Entra can restrict who a scoped admin may include. AUs are not the same object as adaptive scopes: AUs are created in Entra for least-privilege admin boundaries; adaptive scopes are created in Purview for dynamic policy targeting. If your account is assigned AUs, you must pick one when you create a scope. Administrative units do not support SharePoint sites, so you cannot create a SharePoint sites adaptive scope if you select AUs. Keep Full directory when you are not restricting by AU. Inactive mailboxes are not supported in a retention policy when you select AUs; an unrestricted admin must use Full directory to include them.

How to create and query a scope

You need a role group that includes Scope Manager. Built-in groups that include it are Compliance Administrator, Compliance Data Administrator, Organization Management, Records Management, Communication Compliance, and Communication Compliance Admins.

1. Sign in to the Microsoft Purview portal.
2. Go to Settings > Roles and scopes > Adaptive scopes.
3. Select + Create scope.
4. Assign an administrative unit or keep Full directory.
5. Select Users, SharePoint sites, or Microsoft 365 Groups, then build the query.

The simple builder supports is equal to, is not equal to, starts with, and not starts with. You can add multiple attributes and group them. Published query maximums: attribute/property value string length 200; attributes or properties without a group, or within a group, 10; number of groups 10; advanced query 10,000 characters; grouping inside a group is not supported, so the maximum properties or attributes in one scope is 100. There is no published limit on how many adaptive scopes you may add to a policy.

The advanced query builder uses OPATH for User and Microsoft 365 Group scopes and Keyword Query Language (KeyQL) for SharePoint sites. Advanced OPATH operators include and, or, not, eq, ne, lt, gt, like, and notlike. You must use advanced query to exclude inactive mailboxes ((IsInactiveMailbox -eq "False")) or to target only inactive mailboxes ((IsInactiveMailbox -eq "True")). The simple builder cannot do that.

SharePoint site scopes include all site types unless you filter. Indexed SiteTemplate values Microsoft documents include SITEPAGEPUBLISHING (modern communication), GROUP (group-connected), TEAMCHANNEL (Teams private channel sites), STS (classic team), and SPSPERS (OneDrive). A communication-sites-only scope is SiteTemplate=SITEPAGEPUBLISHING.

The query does not run immediately, and the wizard does not validate that you typed Europe versus EU. Factor up to five days for queries to fully populate before you depend on the scope in a policy. Microsoft tells you to wait a few days after creating a new scope.

Validate User and Group OPATH with Exchange Online PowerShell (Get-Recipient, Get-Mailbox, or Get-User -Filter). Use Get-Recipient or Get-User in hybrid scenarios because Get-Mailbox does not support MailUser. Validate site KeyQL at https://<tenant>.sharepoint.com/search. Returned recipient counts can be higher than licensed users; unlicensed accounts will not receive policy settings.

Open an existing scope > Scope details to see members with state Added or Removed. Export to CSV, or use Get-AdaptiveScopeMembers when membership is large. The details list can show up to 1 million members across added and removed; the scope itself can apply to more than 1 million members. Arbitration mailboxes can appear in the portal member list but not in the PowerShell validation output. Member details can lag up to five days.

Exam trap: Preservation Lock locks a retention policy or retention label policy so nobody—including a global admin—can turn it off, delete it, or make it less restrictive. Currently, adaptive policy scopes do not support Preservation Lock. If the scenario requires that lock, you cannot choose adaptive for that policy.