Retention schedules in Microsoft 365: the gap most public bodies miss

Every public body has a retention schedule: a list of record classes, how long each must be kept, which event starts the clock and what happens at the end, destruction or permanent conservation. In Quebec, the Archives Act requires every public body to establish one and keep it up to date. On paper, it governs every record the organization holds.

In Microsoft 365, it often stops halfway. The schedule has been translated into retention labels, sometimes with great care. But teams created for a project that ended years ago are still there, SharePoint sites keep growing, and nobody runs the disposal. The gap becomes visible at specific moments: a directorate is reorganized, a shared drive is about to be retired, an access-to-information request turns up documents that should have been destroyed long ago, or the annual disposal campaign comes around and nobody knows where to start.

Why does the retention schedule stop at the labels?

Because the schedule and Microsoft 365 are managed by different people, in different terms.

• Archivists think in files and record classes. The schedule describes a committee's minutes, a contract file, a grant application.
• IT thinks in sites, libraries and policies. Microsoft 365 is organized into Teams, SharePoint sites and document libraries, created by users as projects come and go.
• Labels encode rules, not decisions. A label can say how long to keep a contract file after it closes and what to do next. It can't tell that this project is closed, or that this particular file deserves a second look.
• Ownership fades. When a project ends or its owner leaves, the team stays. Nobody feels entitled to delete it.
• Creating is easy, closing isn't. Anyone can create a team in a few clicks, but no step in the usual workflow asks anyone to close one.

Meanwhile, network drives hold years of folders nobody dares delete, and paper boxes are tracked in spreadsheets with disposal dates calculated by hand. Each medium ends up with its own partial process, or none at all.

What it costs

Without a working disposal process, public bodies fall back on one of two defaults, and both carry risk.

• Keep everything, to be safe. Storage grows, search gets noisier, and every record kept beyond its period is one more document that may have to be reviewed when an access-to-information request comes in. Personal information kept longer than necessary also widens the exposure if a confidentiality incident occurs.
• Destroy without solid evidence. Deleting a site or a folder without an approved disposal report leaves the organization unable to show what was destroyed, under which rule and on whose authority.

Then there's the time. Applying the schedule by hand across Teams, SharePoint, drives and boxes takes hours of archivist work for every disposal campaign, much of it spent building lists rather than making decisions. And when a public body can't say what it destroyed, or why it still holds what it should have disposed of, it's harder to answer auditors, citizens or the media with confidence.

What doesn't work

Labels on their own. Configuring labels to delete automatically at the end of the period removes the administrative decision from the process. Labels that only retain, with no disposition step, simply push the problem down the road.

Relying only on Purview disposition review. Microsoft Purview's disposition review is a real review: up to five stages, with reviewers who can approve disposal, relabel an item or extend its retention. But it's triggered item by item as each label's timer expires, and it's configured label by label by an administrator in the compliance portal. It can be set to auto-approve after a period without action, it has no built-in action for transferring records to the national archive, and it covers content stored in Microsoft 365. For a detailed comparison, see Microsoft Purview vs. Archiveo: who should run records disposition?

Asking site owners to clean up. Site owners aren't archivists. They delete too much or too little, and leave no trace of what they removed.

One-off cleanup projects. A big cleanup before a migration helps once. Without a standing process, the backlog is back within a few years.

How to close the gap

The method doesn't depend on any particular tool. It treats the schedule as a process archivists run, with proof at every step.

1. Keep one set of rules. Translate each schedule rule into a retention label with its period, its trigger and its final disposition. The labels become the single reference; don't maintain a second copy elsewhere.
2. Link every site, drive and box to a unit. Each Teams or SharePoint site, network share and paper box should have an owning unit and, ideally, a record class.
3. Start disposition on demand. Launch a request for a defined scope when it makes sense: a project closes, a committee is dissolved, a directorate is reorganized, a drive is retired, or the annual campaign begins.
4. Build the disposal report before acting. List everything in the scope that has reached its due date, with the rule that applies to each item.
5. Approve at two levels. The archivist validates that the report complies with the schedule; the manager responsible for the records approves it. Nothing runs before both.
6. Execute and verify. Destroy and confirm the content is no longer accessible, recycle bin included, or move records with permanent value through a buffer zone and transfer them to the national archive.
7. Keep the audit trail permanently. The record of what was destroyed or transferred, under which rule and with whose approval, must survive the content itself.

Start small. A first request on a single closed project or a retired drive tests the rules, the approvals and the evidence on a manageable scope. It also gives archivists and managers a concrete example to refer to before the annual disposal campaign.

How LS2 approaches it

For government and public bodies, LS2 Innovation offers Archiveo, which applies the retention schedule to Microsoft 365, network drives and paper from one place. It builds on Purview rather than replacing it: Microsoft 365 retention labels are imported in bulk with their period, trigger and final disposition, so the labels stay the single reference.

• Microsoft 365. The archivist creates an archive request for a Teams or SharePoint site, scoped to specific folders or files if needed. Each request moves from Draft to Approved to Transferred to Completed.
• Network drives. Expired folders are proposed based on their creation or last-modified date. Files stay on the drive until a decision is approved, and approved items pass through a buffer zone so mistakes can be corrected before destruction.
• Paper. Each box and file gets a record with its location, contents and computed disposal date. Archiveo prints barcode labels, logs moves, loans and returns, and imports the existing inventory instead of re-keying it. The certificate of destruction is attached to the request.

Every request follows the same path: disposal report, archivist validation, manager approval, then either verified destruction or a buffer zone and transfer to the national archive over secure FTP, closed once the archive confirms receipt. There's no auto-approval, and the audit trail is permanent. Archivists and managers work in a Microsoft Teams tab, on the web or on mobile, with nothing to install.

Setup is mostly archival work, not technical work: IT connects Microsoft 365 and any network drives, the rules and the paper inventory are imported, roles are configured, and LS2 accompanies the archivists through their first archive request. Learn more about LS2 Innovation, see how LS2 works with partners that serve public bodies, or contact the team. Where vendors hold personal information on your behalf, our Law 25 due-diligence checklist covers the retention and destruction clauses to look for.