<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-email-retention-policies
description: >-
  Design, deploy, and enforce email retention and disposition policies aligned with regulatory requirements and litigation hold obligations.
domain: cybersecurity
subdomain: email-security
tags:
  - email-retention
  - data-lifecycle
  - compliance
  - ediscovery
  - archival
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1114"]
---

# Implementing Email Retention Policies

## Overview

Email retention policies define how long messages are preserved, when they
are purged, and how litigation holds override normal disposition. Proper
retention balances regulatory obligations (SEC 17a-4, HIPAA, GDPR Art. 5(1)(e))
against storage costs and data minimization principles.

## Prerequisites

| Requirement | Install |
|---|---|
| Exchange Online / Google Workspace | Admin access to retention settings |
| Compliance Center | Microsoft Purview or Google Vault access |
| Python 3.10+ | For agent tooling |
| Legal input | Retention schedule approved by legal counsel |

## Key Concepts

### Retention Labels & Policies

Labels classify content by retention period. Policies assign labels to
mailboxes, groups, or locations automatically:
- **Auto-applied** — keyword, sensitive info type, or trainable classifier
- **User-applied** — published to Outlook for manual tagging
- **Default** — applied when no other label matches

### Litigation Hold

Overrides retention deletion. Preserves all versions of items in scope.
Hold types: in-place hold, eDiscovery hold, retention with preservation lock.

### Disposition Review

When retention period expires, items enter disposition review before
permanent deletion. Reviewers validate no legal or business need remains.

## Workflow

1. **Inventory regulatory obligations** — map retention periods per regulation
2. **Define retention schedule** — classify email types with retention durations
3. **Configure retention labels** — create labels in compliance portal
4. **Apply retention policies** — assign labels to mailbox scopes
5. **Configure litigation hold** — set up hold for active legal matters
6. **Validate enforcement** — verify items retained and disposed correctly
7. **Audit and report** — generate compliance evidence for auditors


## Detection

```yaml
title: Detect Email Retention Policy Deletion or Reduction
id: d4e5f6a7-b8c9-0123-defa-234567890123
status: experimental
description: Detects deletion or reduction of email retention policies, which may indicate evidence destruction.
logsource:
  product: microsoft365
  service: exchange_admin_audit
detection:
  selection:
    Operation:
      - 'Remove-RetentionPolicy'
      - 'Set-RetentionPolicy'
    Parameters|contains: 'RetentionDays'
  condition: selection
falsepositives:
  - Legitimate administrative activity from authorized accounts
level: medium
tags:
  - attack.t1485
  - attack.impact
```

## Verification

| Check | Method |
|---|---|
| Policies applied | Retention policies show Active status in compliance portal |
| Labels assigned | Mailbox content tagged with correct retention labels |
| Hold effective | Held items preserved past normal retention period |
| Disposition works | Expired items enter review queue on schedule |
| Audit trail | Retention actions logged in unified audit log |

## References

- [Microsoft Purview Retention](https://learn.microsoft.com/en-us/purview/retention)
- [SEC Rule 17a-4](https://www.sec.gov/rules/final/34-38245.txt)
- [GDPR Art. 5 — Storage Limitation](https://gdpr-info.eu/art-5-gdpr/)
- [Google Vault Retention](https://support.google.com/vault/answer/2990828)
