SC-401 retention explained
Retention is the second half of the 30–35% domain Implement data loss prevention and retention. Retention in Microsoft Purview means keeping content for a period, deleting it after a period, or both. The exam tests the choice between retention policies and retention labels, how scopes are targeted, what happens when several retention rules overlap, and how to get content back.
Policy or label?
| Retention policy | Retention label | |
|---|---|---|
| Applies to | Whole locations: mailboxes, sites, Teams, groups | Individual items |
| Targeting | Locations, optionally narrowed by scope | Published for users to choose, or auto-applied by condition |
| Can mark as record | No | Yes, including regulatory records |
| Disposition review | No | Yes |
| Typical use | Delete all Teams chats after two years | Keep each contract seven years, then review |
Use a policy when the rule is the same for everything in a location. Use a label when different items need different treatment, or when you need records, event-based retention or a disposition review.
Labels in practice
A retention label defines what happens during and after the retention period: retain, retain then delete, or only delete; trigger it from creation, last modification, labelling date or an event. A label does nothing until it reaches content, which happens in one of two ways:
- Publish it through a label policy so users or admins choose it.
- Auto-apply it through a policy that looks for a sensitive info type, keywords, a trainable classifier or a content property. Auto-application is not instant; allow time for it to take effect.
At the end of the period you can delete automatically, trigger a disposition review, or leave the item and mark it eligible.
Adaptive scopes
A static scope names specific mailboxes or sites. An adaptive scope uses a query, for example users where department equals Finance, or sites matching a property. Membership changes as attributes change, so the policy follows people and sites automatically. Scope types include users, groups and sites. Adaptive scopes are the answer when a requirement says the policy must keep up with reorganisations or new sites.
When rules overlap
A single item can fall under several policies and labels. The principles, in order of thinking about them:
- Retention wins over deletion: content under a retention period is not deleted even if another rule says delete.
- The longest retention period wins.
- Explicit wins over implicit: a retention label applied to an item beats a policy applied to its location.
- The shortest deletion period wins when deletion is otherwise allowed.
Policy lookup in Purview lets you check which retention policies and labels apply to a specific user, group or site, which is the first stop when someone asks why an item was or was not deleted.
Recovering retained content
Content that users delete does not simply vanish when it is retained. For SharePoint and OneDrive, it moves to the Preserve Hold Library; for mail, it sits in hidden folders of the mailbox such as the Recoverable Items folder. Admins can search these locations, and the recycle bin and recoverable-items timelines apply on top of retention.
Three example questions
Question 1. Marketing contracts must be kept for six years, reviewed by the records team and then deleted, while other documents in the same library have no retention requirement. What is the best design?
- A. A retention label with a disposition review, published or auto-applied to contracts
- B. A retention policy on the whole SharePoint site
- C. A sensitivity label named Contract
- D. A DLP policy in audit mode
Show answer
Answer: A
A retention label with a retention period and a disposition review, applied only to contracts, matches item-level behaviour. A policy on the whole site would affect every document. A sensitivity label does not control retention. A DLP policy cannot retain or delete content.
Want more questions like this? Full SC-401 practice tests →
Question 2. A document is covered by a policy that retains for 3 years and another that deletes after 1 year. What happens at the one-year mark?
- A. The document is deleted
- B. Both policies stop applying
- C. The shortest period always wins
- D. The document is retained because retention wins over deletion
Show answer
Answer: D
Retention takes priority over deletion, so the content is retained until the retention requirement ends; the delete period cannot remove it. The statements that the document is deleted at once, that the shorter period wins in all cases, or that the policies cancel each other are incorrect.
Want more questions like this? Full SC-401 practice tests →
Question 3. You need a retention policy that always covers the current members of the Legal department even as people join and leave. What should you configure?
- A. A static scope listing the current mailboxes
- B. A sensitivity label for Legal
- C. An adaptive scope with a department-based query
- D. A one-time CSV of user names
Show answer
Answer: C
An adaptive scope built on a department attribute updates membership dynamically. A static scope would need manual maintenance. A sensitivity label does not decide retention, and a one-time export of users to a list becomes outdated.
Want more questions like this? Full SC-401 practice tests →
What to practise
Create an adaptive scope, a retention policy that uses it, a published retention label with a disposition review, and then use Policy lookup on a test user. Compare how this differs from sensitivity labels, which protect rather than retain.