At an IRMS public sector group meeting in London yesterday I heard Rob Bath compare the records retention model offered within the on-premise SharePoint with that offered in Office 365.
Rob described the two models available in on-premise SharePoint:
- the record centre model in which important items are moved to a records centre – the disadvantage of this model is that it rips content out of context by taking it from the SharePoint sites in which users had interacted with it;
- the in-place record management model in which end users can click a button to identify individual items as records – the disadvantage of this model is that SharePoint gives no reporting capability for information managers to see and manage the items scattered across their SharePoint implementation that have been declared as records.
Both the record centre model and the in-place model are still available within SharePoint Online in Office 365. However Office 365 offers another way of managing the retention of SharePoint Online content. This new method does not sit within SharePoint Online itself. It sits in the Office 365 Security and Compliance centre which exists to provide a means of managing content across the Office 365 family of applications.
The Security and Compliance centre provides a facility to set up retention labels and retention policies:
- retention labels can be applied to containers within SharePoint sites such as libraries or folders;
- retention policies can be applied at SharePoint site level.
Rob’s conclusion was that the retention labels/retention policies model offered in the Office 365 Security and Compliance centre was both a simpler and more effective way of managing SharePoint content than the two models available within SharePoint itself. One member of the audience asked him whether there were any circumstances in which he would recommend the use of either the record centre model or the in-place model in place of (or in conjunction with) the retention labels/retention policies model within Office 365. Robert thought for a second and then said ‘no’.
In the rest of this post I will offer some thoughts on why it is that after so many years of coming up with such unwieldy retention offerings in SharePoint, Microsoft have come up with something so much better for Office 365.
The need for Office 365 to have a retention model that went beyond SharePoint
Microsoft wanted a records retention model for Office 365 that was not unique to any one particular Office 365 application, but which could be applied to all of the major applications within the Office 365 family. This forced them to come up with a model that was not based on any features specific to SharePoint itself. In particular it led to them to moving away from the linkage between records retention and SharePoint content types.
The need to come up with a model that could be applied to applications as diverse as SharePoint Online, the Exchange Online email system, and the OneDrive filesharing application meant that Microsoft had to look for a common denominator between the different applications. The one common denominator between the applications is that they all aggregate content.
The records retention model in Office 365
The retention model in Office 365 is very simple. For each application a fundamental aggregation is identified. In Exchange it is the email account. In SharePoint it is the site. In OneDrive it is the OneDrive account, etc.. The Office 365 Security and Compliance centre allows you to use the fact that all content in SharePoint is held within sites, all content in Exchange is held within email accounts etc. to apply your retention rules.
The Security and Compliance Centre offers essentially two different strategies for linking retention rules to content:
- The most basic approach is that you apply retention at the level of the fundamental aggregation. You set up retention policies in the Security and Compliance Centre and you identify which SharePoint sites (and/or which Exchange email accounts, which OneDrive accounts etc.) you wish to apply each policy to.
- A more sophisticated approach is that you manage retention at a level below the fundamental aggregation. In this model you set up your retention rules as retention labels (rather than retention policies) in the Security and Compliance centre, and then you target the rules at the SharePoint sites/Exchange email accounts etc. in which you want them to be available for users to apply to content
Applying retention policies and/or retention labels to content in Exchange Online and in SharePoint Online
It is possible to use different strategies to apply retention labels/policies in different ways in different Office 365 applciations,
My preference for email is to set a retention policy on email accounts based on the business value of the correspondence (which will vary according to the role played by the individual email account holder), and in addition to allow users to use a retention label to flag up personal correspondence so that it can be subject to a shorter retention period.
After his talk I asked Rob Bath whether he preferred to apply retention policies or retention labels in the SharePoint environment. He said that he thought that a SharePoint site was typically too big an aggregation to apply one retention policy to. He prefers to apply retention labels to libraries and folders within sites. The way to do this is to set up your retention rules as retention labels and then identify for each label the SharePoint sites that it is relevant too. The result will be that most SharePoint sites will only have a small number of retention labels available to manage content within them. In the process of creating any new library or new folder the library/folder can be configured to apply one of those retention labels to all content stored within it (see here).
It is important to ignore Microsoft’s pushing of retention labels as a tool for end-users to tag individual items in SharePoint. There is no incentive for an end user to choose a retention period for an individual document. In general it is not good practice to ask end users to do something you know they will not do. In the SharePoint environment you should either:
- Set retention labels as default on libraries or folders; OR
- set retention policies as default on SharePoint sites (do this if setting retention labels on libraries/folders is not possible, perhaps because your SharePoint installation is too big, your number of information governance staff is too low, your roll-out schedule is too short, or you are applying retention labels/policies in a legacy environment)