Create a preservation policy

Organizations often want to preserve content for a certain period of time, to comply with industry regulations or internal policies. With a preservation policy, you can preserve content in sites, mailboxes, or public folders indefinitely or for a specific duration. You can also filter the content that will be preserved by supplying keywords or a date range to narrow the results.

For example, you can preserve the content in specific mailboxes and sites belonging to the Sales Department for seven years, and further narrow the scope of the policy by saying that you want to preserve only content from the last two years that contains a specific client’s name. If someone edits or deletes content that’s subject to a preservation policy, a copy is saved to a secure location where it’s preserved while the policy is in effect.

You also have the option to lock the policy. Preservation Lock is for organizations that need to comply with rules defined by regulatory bodies such as the Securities and Exchange Commission (SEC) Rule 17a-4, which requires that after a preservation policy is turned on, it cannot be turned off or made less restrictive. With Preservation Lock, after a policy’s been locked, no one—including the administrator—can turn off the policy or make it less restrictive.

If your organization isn't required to use Preservation Lock, you can edit or disable a preservation policy at any time, including before the end of the time period specified by the policy.

For more information, see Overview of preservation policies.

Retention page in Office 365 Security & Compliance Center

Note: To include an Exchange Online mailbox in a preservation policy, the mailbox must be assigned an Exchange Online Plan 2 license. If a mailbox is assigned an Exchange Online Plan 1 license, you would have to assign it a separate Exchange Online Archiving license to include it in a preservation policy.

Create a preservation policy

  1. In the Security & Compliance Center > Data management > Retention in the left navigation > under Preserve > New (+).

    Use the Add command on the Retention page to create a preservation policy
  2. Enter a name and description > Next.

  3. Choose whether you want to preserve content in mailboxes, sites, or public folders > Next.

    Select from mailboxes, sites and public folders for locations for search in a new preservation policy
  4. If you’re adding mailboxes > choose Add (+) > search for mailboxes or distribution lists > select them > add > OK when done adding mailboxes > Next.

    Note: If you add a distribution list to the policy, the mailboxes within the group are expanded and each mailbox in the group is designated as being subject to the preservation policy. Only mailboxes in the distribution list when the policy is created are preserved. Mailboxes subsequently added to or removed from the distribution list are not added or removed from the preservation policy.

  5. If you’re adding sites > choose Add (+) > enter the URL of each site > add > OK when done adding sites > Next.

    Notes: To add a site to the preservation policy, the site first needs to be indexed by the SharePoint Online search service. If the site was recently created, it may take some time for the site to be indexed.

    When you apply a preservation policy to a site, the policy’s automatically applied to all subsites of that site.

  6. If you're adding public folders, you can choose to include all public folders but not a specific public folder.

  7. To limit the policy to specific content, do any of the followingand then choose Next:

    • Enter a query or keywords that you want the content to contain. For example, Northwind AND sales, as shown in the following figure. A preservation policy supports Keyword Query Language (KQL). For more information on KQL, see Create a query to filter a preservation policy.

    • Choose a start date or end date:

      • For messages, the date is relative to the received date.

      • For mailbox items that aren’t sent, like notes, the date is relative to the creation date.

      • For documents and sites, the date is relative to the last modified date.

      Using keywords and date ranges as filters when creating a preservation policy
  8. To specify the duration of the policy, do one of the following > then choose Next:

    • To preserve the content indefinitely, until the policy is disabled, choose Indefinitely.

    • To preserve the content for a specific period of time, either choose an option in the list, or choose Custom, and then enter a number of days, months, or years.

      Note: The duration of a preservation policy starts from the date when a document is last modified or the date when a message is delivered -- not the time the policy was created.

      Duration setting for a new preservation policy
  9. If your organization must comply with a stringent requirement such as SEC Rule 17a-4, which requires that after a preservation policy is turned on, it cannot be turned off or made less restrictive, choose Yes, turn on Preservation Lock.

    If this requirement doesn't apply to your organization, choose No, don’t turn on Preservation Lock.

    After a policy’s been locked, no one— including the administrator—can turn off, disable, or remove content from the policy. And it’s not possible to modify or delete content that’s subject to the policy during the preservation period. After the policy’s been locked, the only ways you can modify the preservation policy are by adding content to it or extending its duration. A locked policy can be increased or extended, but it can’t be reduced, disabled, or turned off.

    Option to turn on Preservation Lock

  10. If you choose to lock the policy, you’ll see this warning. Before you lock a preservation policy, it’s critical that you understand your organization’s compliance requirements, and that you do not lock a policy until you are certain that it’s what you need. After a policy’s locked, it cannot be turned off or disabled.

    If you’re certain that your organization needs a locked policy in order to satisfy your compliance requirements, choose Yes.

    Warning about locking a policy

  11. Choose whether to turn on the policy now or later.

    If you don’t turn on the policy now, you can always turn it on later from the Retention page of the Office 365 Security & Compliance Center.

    Option to turn on preservation policy

  12. Review the details of the preservation policy > Create.

    Review settings for a preservation policy, including name, description, search locations, keywords, time frame for searches, length of time to preserve content, preservation lock, & policy turn on or off

After you create a preservation policy, you’ll want to monitor its status to make sure that it’s successfully deployed and applies to its content sources and to see if there are any errors that need to be resolved. For more information on different statuses, see the next section.

After the policy's been created, it’s deployed to the selected content sources, and the selected sources are preserved. Policy deployment can take up to 24 hours.

Notes

  • A preservation policy can contain no more than 1,000 mailboxes and 100 sites.

  • A tenant can contain no more than 1,000 preservation policies.

View the status of a preservation policy

At any time, you can view the status of your preservation policies on the Retention page of the Security & Compliance Center. Here you can find important information, such as whether a policy was successfully enabled or disabled, and whether the policy contains any errors.

Here are the different status and what they mean.

Status

Explanation

Turning on…

The policy is being deployed to the content sources that it includes. The policy is not yet enforced on all sources. Policy deployment can take up to 24 hours.

On

The policy is active and enforced. The policy was successfully deployed to all its content sources.

On (with errors)

The policy was deployed but was not applied to one or more content sources; there are errors to resolve.

In the details pane on the right, choose View error details to view the errors.

Turning off…

The policy is being removed from the content sources that it includes. The policy may still be active and enforced on some sources. Disabling a policy may take up to 45 minutes.

Off

The policy is not active and not enforced. The settings for the policy (sources, keywords, duration, etc) are saved.

Off (with errors)

The policy was disabled but was not removed from one or more content sources; there are errors to resolve.

In the details pane on the right, choose View error details to view the errors.

Deleting…

The policy is in the process of being deleted. The policy is not active and not enforced.

Edit a preservation policy

You can edit the settings of a preservation policy on the Retention page of the Security & Compliance Center by selecting the policy and choosing Edit.

When you edit a policy, you can change any of the policy settings. For example, you can:

  • Add or remove content sources (sites, mailboxes, or public folders).

  • Change the keywords or time frame.

  • Change the duration.

  • Enable or disable the policy.

If you add or remove a source from the preservation policy, such as a site or mailbox, the change is deployed to the content source. In this case, you want to monitor the status of the policy to make sure that all sources are successfully added to or removed from the policy.

Disable a preservation policy

You can disable a preservation policy on the Retention page of the Security & Compliance Center by selecting the policy and choosing Turn off in the details pane on the right.

Option for turning off a preservation policy on the Retention page of the Security & Compliance Center

You can disable a preservation policy at any time, including before it’s reached the end of its duration. However, it’s important to understand that when you disable a preservation policy, any content that was preserved by that policy (in a Preservation Hold library or Recoverable Items folder) will be deleted if that content is not included in any other policy.

When you disable a preservation policy, the settings for the policy (sources, keywords, durations, etc) are saved, so you can enable the policy later if you need to.

After you disable a preservation policy, it may take up to 45 minutes to process the change. You’ll want to monitor the status of the policy to make sure that all sources are successfully removed from the policy and to see if errors need to be resolved. If you see the status Disabled (with errors), in the details pane on the right, choose the link View error details to view the errors.

Delete a preservation policy

You can delete a preservation policy on the Retention page of the Security & Compliance Center by selecting the policy and choosing Delete.

When you delete a preservation policy, it’s automatically disabled for all the sources (sites, mailboxes, and public folders) that it contains. If there are errors disabling the policy, the errors need to be resolved before the process of deleting the policy can be completed. An active preservation policy can’t be deleted. Also, policies can’t be deleted while they’re being deployed (with a status of Turning on…).

Warning when deleting a preservation policy

When you delete a preservation policy, any content that was preserved by that policy (in a Preservation Hold library or Recoverable Items folder) will be deleted if that content is not included in any other policy.

See Also

Overview of preservation policies

Create a query to filter a preservation policy

Share Facebook Facebook Twitter Twitter Email Email

Was this information helpful?

Great! Any other feedback?

How can we improve it?

Thank you for your feedback!

×