Retention policy, litigation hold and archive mailbox
Three ideas get mixed up. Retention steers the lifecycle: keep for a period, then delete automatically or leave a label in place. Litigation hold (or eDiscovery hold) freezes content because of a legal or investigative need — deletion is blocked even if someone empties a folder. An archive mailbox is mainly capacity: older mail moves out of the primary mailbox so it does not fill up, which is not the same as “keep this for seven years”.
If you do not separate those three, you either keep too much data without a purpose, or you delete by accident while thinking “archive” was enough protection. Say out loud: are we keeping for operations, for a hold, or only for storage comfort?
What to keep — and not keep — for mail and files
There is no universal SME period that fits everyone. There is a usable frame:
- Operational mail and Teams chats: often months to a few years — long enough for follow-up, short enough that you are not dragging forever.
- Contracts, invoices, HR files in SharePoint or OneDrive: longer, tied to what your finance or adviser already requires — not “because Microsoft can”.
- Personal clutter and duplicate downloads: not forever; clean-up belongs in the policy, or search becomes unusable.
Retention is not a substitute for a real backup with a practice restore. Keeping data in the cloud is not the same as recovering after ransomware or a mass delete — see also why cloud is not a backup. Audit events (who shared what) belong with the audit log, not with retention of the content itself.
Who decides the retention periods
This is not an IT-only decision. Leadership or a process owner decides what you must be able to retrieve (complaint, claim, audit, statutory keep). IT or Floor ICT maps that to scopes: which workloads (Exchange, SharePoint, OneDrive, Teams), which exceptions (for example leadership mailboxes), and whether deletion after the period is allowed. Without that owner, retention stays a switch without a story — or a forever-default nobody dares to change.
Write one page: periods per content type; whether auto-delete is on; who may start a hold; and how often you review the policy (for example yearly).
What Floor ICT configures — and what you decide
In the Microsoft 365 tenant we typically: set retention policies or labels to your written choice; scope the right workloads; apply exceptions you approved; and explain what users may still delete. We enable litigation hold only when you ask for it deliberately (legal or investigation) — not as a silent “keep everything forever” workaround. We set up archive mailboxes for storage pressure, not as proof of retention.
You still decide: the periods, which content types need longer keep, and whether deletion after expiry is acceptable. Essential, Advanced or Elite say nothing about retention; that is tenant configuration next to the MSP package.
More depth
Checklist for SME directors
1) List the content types you truly need (mail, contracts, chats). 2) Set a period and a reason per type. 3) Separate retention from hold and from archive mailbox. 4) Name an owner. 5) Let Floor ICT configure the policy. 6) Review yearly or after an incident.
Retention label versus policy
A policy applies broadly (for example all mailboxes); a label attaches to specific sites or content types. For an SME, one clear policy plus a few exceptions often beats twenty labels nobody maintains.
Relation to shared mailboxes
Info@ and sales@ fall under the same retention rules as named users unless you scope them differently on purpose. See shared mailboxes: access rights and retention are separate decisions.