The Purview retention policy that quietly keeps every email forever

by | Jul 16, 2026 | Tutorials | 0 comments

I was asked to explain, in plain terms, what happens to a deleted email in Microsoft 365 and how long it can still be found. The question came up because of a subject access request, and the honest answer turned out to be “forever”, which was not what anyone expected. This post is the audit I ran, what I found, and why one well-meaning Purview setting changes the answer for the whole tenant.

The layers that decide how long mail lives

Several independent settings overlap, and the longest one wins.

  • Deleted item retention on the mailbox (RetainDeletedItemsFor, 14 days by default, up to 30).
  • Single item recovery, which keeps purged items recoverable for the same window.
  • Litigation holds and eDiscovery holds on specific mailboxes.
  • Messaging records management (MRM) tags and policies, the older Exchange mechanism, often used for things like “delete recruitment folders after six months”.
  • Purview retention policies, which can be scoped to the whole organisation or to adaptive scopes.
  • Inactive mailboxes, which are leavers’ mailboxes kept because a hold or policy applies.

The read-only audit

Everything below is a read. Nothing changes.

Connect-ExchangeOnline
Get-Mailbox -ResultSize Unlimited |
    Select DisplayName, RetainDeletedItemsFor, SingleItemRecoveryEnabled,
           LitigationHoldEnabled, InPlaceHolds, RetentionPolicy
Get-RetentionPolicy | Get-RetentionPolicyTag
Get-Mailbox -InactiveMailboxOnly

Connect-IPPSSession
Get-RetentionCompliancePolicy -DistributionDetail
Get-RetentionComplianceRule
Get-AdaptiveScope

What I found

An organisation-wide Purview policy set to retain items forever, applied to all Exchange mailboxes. Someone had created it years earlier with the best of intentions, probably “let’s never lose anything”.

The effect is an indefinite hold on every mailbox:

  • The 14-day recoverable window is meaningless. Purged items are kept in the Recoverable Items folder indefinitely.
  • MRM deletion policies never actually destroy anything. The recruitment folder that was supposed to be purged after six months is still fully searchable.
  • Every leaver becomes an inactive mailbox that is kept forever.
  • A subject access request has to search all of it, because all of it is still there.

That last point is the real cost. UK GDPR’s storage limitation principle says you keep personal data no longer than necessary. A “keep forever” policy that overrides your own deletion rules is hard to defend, and it makes every SAR larger and slower.

The device-code workaround for headless sessions

I ran this from a Linux box with no browser. Connect-ExchangeOnline supports -Device, but Connect-IPPSSession does not. The workaround is to do the device-code flow yourself against the compliance endpoint, then exchange the refresh token for an Exchange Online token so one sign-in covers both. It is a page of PowerShell and I will share it separately, but the short version is: request a device code for the https://ps.compliance.protection.outlook.com/.default scope, poll for the token, then use the refresh token to get https://outlook.office365.com/.default.

What to do about it

Do not delete the policy on a Friday afternoon. Agree the retention periods you actually need, build them as scoped Purview policies with real end dates, put specific legal holds on the mailboxes that genuinely need them, and only then retire the forever policy. And write down what you decided, because in a few years someone will ask why that mailbox from 2019 is gone.

Submit a Comment