Setting/Amending Retention Policies in M365

[EssentialRug]

Hi all,

 

Have previously set a retention policy in the Compliance admin centre under Data Lifecycle Management > Retention, however I'm now unable to add or amend policies...the option to do so just doesn't show.

 

 

Am using a global admin account but still nothing. Anyone have any ideas?

[kennysarmy]

Could it be this?

 

We've had issues for months :/

 

 

 

After much discussion and deliberation with Microsoft, I finally got some helpful information.

 

There has been a degradation of services since March 2nd this year and this is what is affecting you and causing us so many headaches.

 

The latest update from Microsoft on this is below:

 

Title: Users’ files in the Preservation Hold Library aren't being deleted by retention policies or retention labels

 

User impact: Users’ files in the Preservation Hold Library aren't being deleted by retention policies or retention labels.

 

Current status: We determined that our fix deployment has successfully completed in our internal test environment and is now being prepared for broad deployment. We'll be able to provide a resolution timeline in our next scheduled update, although we do continue to anticipate initiating the broad deployment in the beginning of September, 2023.

 

Scope of impact: Your organization is affected by this event, and users’ files within the SharePoint Online and OneDrive for Business Preservation Hold Library document library aren't being deleted by Data Lifecycle Management and Records Management retention policies or retention labels.

 

Start time: Thursday, March 2, 2023 at 12:00 AM GMT

 

Root cause: A Preservation Hold Library update resulted in disruption of the delete processing service, which removes files in accordance with your configured retention policies or retention labels, causing the impact.

 

Next update by: Wednesday, September 6, 2023 at 7:30 PM GMT+1

[EssentialRug]

Could it be this?

 

We've had issues for months :/

 

 

 

After much discussion and deliberation with Microsoft, I finally got some helpful information.

 

There has been a degradation of services since March 2nd this year and this is what is affecting you and causing us so many headaches.

 

The latest update from Microsoft on this is below:

 

Title: Users’ files in the Preservation Hold Library aren't being deleted by retention policies or retention labels

 

User impact: Users’ files in the Preservation Hold Library aren't being deleted by retention policies or retention labels.

 

Current status: We determined that our fix deployment has successfully completed in our internal test environment and is now being prepared for broad deployment. We'll be able to provide a resolution timeline in our next scheduled update, although we do continue to anticipate initiating the broad deployment in the beginning of September, 2023.

 

Scope of impact: Your organization is affected by this event, and users’ files within the SharePoint Online and OneDrive for Business Preservation Hold Library document library aren't being deleted by Data Lifecycle Management and Records Management retention policies or retention labels.

 

Start time: Thursday, March 2, 2023 at 12:00 AM GMT

 

Root cause: A Preservation Hold Library update resulted in disruption of the delete processing service, which removes files in accordance with your configured retention policies or retention labels, causing the impact.

 

Next update by: Wednesday, September 6, 2023 at 7:30 PM GMT+1

 

Hmm yeah it could be I guess. Are you able to amend or create a new retention policy?

[kennysarmy]

Hmm yeah it could be I guess. Are you able to amend or create a new retention policy?

 

Yes - but they don't seem to work consistently so we we're on hold until they update us....

[DavR]

This is interesting - we're having the exact same problem with retention policies. Can't edit or create new ones, the whole thing is read only in the GUI.

 

We've had a support case open for a month or more (give or take a few weeks of holiday), they've done a shared screen session and taken logs, but nothing useful has come of it yet.

 

In the meantime, I've been able to make the changes I need via PowerShell, but it's always a steep learning curve (for me, at least), learning a whole new batch of PowerShell commands, when the GUI is *right there*

[kennysarmy]

This is interesting - we're having the exact same problem with retention policies. Can't edit or create new ones, the whole thing is read only in the GUI.

 

We've had a support case open for a month or more (give or take a few weeks of holiday), they've done a shared screen session and taken logs, but nothing useful has come of it yet.

 

In the meantime, I've been able to make the changes I need via PowerShell, but it's always a steep learning curve (for me, at least), learning a whole new batch of PowerShell commands, when the GUI is *right there*

 

MS have asked if we can create a new retention policy using powershell :/

 

Would you have any code that you have used to save me spending hours trying to work it out?

 

Ideally I want to create a new policy in a disabled state so I know I'm not going to bork anything...

 

Cheers

[DavR]

Hi @kennysarmy,

 

I've not had to create a policy, all I've done is add and remove exchange mailboxes from the various policies. Here's the code that I've got, all using the Exchange Online PowerShell module.

 

To connect to in PowerShell to edit compliance policies:

 

Connect-IPPSSession

 

List current mailboxes included in retention policy:

 

Get-RetentionCompliancePolicy -Identity "[POLICY NAME]" -DistributionDetail | Select -ExpandProperty ExchangeLocation | ft

 

List current mailboxes excluded from retention policy:

 

Get-RetentionCompliancePolicy -Identity "[POLICY NAME]" -DistributionDetail | Select -ExpandProperty ExchangeLocationException | ft

 

Add mailbox to retention policy:

 

[font=Consolas]Set-RetentionCompliancePolicy [/font][font=Consolas]-Identity "[POLICY NAME]" -AddExchangeLocation "[MAILBOX [/font][font=Consolas]NAME]"[/font]

 

Exclude mailbox from retention policy:

 

Set-RetentionCompliancePolicy -Identity [font=Consolas]"[POLICY NAME]" [/font]-AddExchangeLocationException "[MAILBOX NAME]"

[EssentialRug]

After a remote support session with Microsoft we are still seeing this issue. They are now 'checking their backend'.

[kennysarmy]

After a remote support session with Microsoft we are still seeing this issue. They are now 'checking their backend'.

 

Of course they are....

[EssentialRug]

Tell me that I've interpreted this wrong, but because we are only on A1, does this mean we no longer have the functionality to create/amend retention policies??

 

[DavR]

Ah frag, I hope not. We're A1 Plus.

 

My previous understanding was A1 et al gets basic retention policies, but you couldn't use adaptive scopes, it was a simple include/exclude. If they're taking away even that, that's really annoying.

 

Although, we've got policies live and in action, without having any licensing above A1 Plus? If we'd gone beyond our licensing I'd expect a big red warning, or for the whole thing to disappear. Not just go read-only in the GUI.

[EssentialRug]

Ah frag, I hope not. We're A1 Plus.

 

My previous understanding was A1 et al gets basic retention policies, but you couldn't use adaptive scopes, it was a simple include/exclude. If they're taking away even that, that's really annoying.

 

Although, we've got policies live and in action, without having any licensing above A1 Plus? If we'd gone beyond our licensing I'd expect a big red warning, or for the whole thing to disappear. Not just go read-only in the GUI.

 

Upon further digging, it seems to be the case...that is terrible.

 

[DavR]

Huh. I wonder if that's a new change, or, whether it was always so, but they're just now shutting down our access to the policies in the GUI. If this is the cause, then it's very poor show, as we've still got (potentially unlicensed) policies in force, that we now don't have GUI access to remove and comply with licensing.

 

I wonder if as a test, adding one A3 or A5 license would re-enable creating and editing policies in the GUI?

[EssentialRug]

Huh. I wonder if that's a new change, or, whether it was always so, but they're just now shutting down our access to the policies in the GUI. If this is the cause, then it's very poor show, as we've still got (potentially unlicensed) policies in force, that we now don't have GUI access to remove and comply with licensing.

 

I wonder if as a test, adding one A3 or A5 license would re-enable creating and editing policies in the GUI?

 

That's a good shout. I'm putting this one on the back burner for the mo as it's already taken up far too much of my time, but if you give it a go let me know!

[kennysarmy]

Huh. I wonder if that's a new change, or, whether it was always so, but they're just now shutting down our access to the policies in the GUI. If this is the cause, then it's very poor show, as we've still got (potentially unlicensed) policies in force, that we now don't have GUI access to remove and comply with licensing.

 

I wonder if as a test, adding one A3 or A5 license would re-enable creating and editing policies in the GUI?

 

I'm going to speak to my Microsoft Licence people about getting an additional licence.

[DavR]

I've just had a conversation with someone from Microsoft support about this issue. They have confirmed that it is a licensing issue.

 

At one point, the Compliance Admin Centre was open and allowed creating policies regardless of license, but they later tightened up on this, which is why we have visible policies in there, but, can no longer edit them.

 

The support agent confirmed that on his own test tenant, he recreated the problem, and then resolved it by adding an A5 license trial.

 

Not sure where this leaves us tbh - other than facing a hefty hike in our licensing bill next year!

[kennysarmy]

I've just had a conversation with someone from Microsoft support about this issue. They have confirmed that it is a licensing issue.

 

At one point, the Compliance Admin Centre was open and allowed creating policies regardless of license, but they later tightened up on this, which is why we have visible policies in there, but, can no longer edit them.

 

The support agent confirmed that on his own test tenant, he recreated the problem, and then resolved it by adding an A5 license trial.

 

Not sure where this leaves us tbh - other than facing a hefty hike in our licensing bill next year!

 

A3 should also do it, is it clear whether just the ADMIN need an A3/5 licence to edit and add policies or do all the mailboxes that you are trying to set on need the higher licence too?

[DavR]

A3 should also do it, is it clear whether just the ADMIN need an A3/5 licence to edit and add policies or do all the mailboxes that you are trying to set on need the higher licence too?

Pretty sure every mailbox covered by the retention policy is going to need the enhanced license, if you want to keep on the legit side of things.

 

Just because one license unlocks the feature set, doesn't mean you only need one licence to use it, has always been my understanding. Every mailbox that benefits from a feature needs to be licenced for that feature - anything else is wishful thinking IMO.

[EssentialRug]

Just checked the Retention page again today on the off chance and looks like I have functionality back to create/amend our policies....anyone else?

[DavR]

Huh, me too!

 

I wonder why they made that change, if indeed it was an intentional change. Seems unlikely they'll have changed the licensing situation.

[EssentialRug]

Huh, me too!

 

I wonder why they made that change, if indeed it was an intentional change. Seems unlikely they'll have changed the licensing situation.

 

Always good to be kept in the loop...thanks Microsoft

[kennysarmy]

Regardless of that, what I've been told repeatedly and categorically by Microsoft is that to use retention policies on mailboxes at school we require at least the A3 licence, A1 does not cut it.

 

So we've just had to spend over £2,500 this year to remain compliant :/

[EssentialRug]

Regardless of that, what I've been told repeatedly and categorically by Microsoft is that to use retention policies on mailboxes at school we require at least the A3 licence, A1 does not cut it.

 

So we've just had to spend over £2,500 this year to remain compliant :/

 

Ridiculous

[DavR]

Regardless of that, what I've been told repeatedly and categorically by Microsoft is that to use retention policies on mailboxes at school we require at least the A3 licence, A1 does not cut it.

 

So we've just had to spend over £2,500 this year to remain compliant :/

 

We might be going the same way tbh - although there are other parts of the A3 package we want, such as AAD P1 and the full version of Intune. That, and the fact that they're killing off the A1 Plus license. It's all starting to stack up as a necessity.