close up of microsoft logo
With the introduction of Advanced Data Governance, Microsoft takes a huge leap forward in the information governance arena PHOTO: Hugo A. Quintero G.

Microsoft announced upcoming capabilities for Advanced Data Governance at the Ignite conference last fall. On April 1, it released these features into the Office 365 platform.  

While retention policies are nothing new for Microsoft, this release marks a big step forward in information governance capabilities coming out of Redmond, Wash.

As with all Office 365 releases, the company is rolling out the features in waves. If you navigate to the Security and Compliance Center, you will see additional options under Classifications and Data Governance. 

The release included a significant number of features, but for the purposes of this discussion, we will focus on those related to information governance and policy.

Unified Retention Policies and Simplified Classification Labels

Microsoft’s capabilities around retention date back, in some cases, over 10 years. Both Exchange and SharePoint feature mechanisms to define how long content items should exist.  

What is new with the recent update is Microsoft’s unification of retention policies across the Office 365 service. Within a series of mouse clicks, users can create a retention policy and apply it to Exchange (email and public folders), SharePoint sites, OneDrive for Business, Office 365 Groups and Skype for Business content.  

This opens up new options for organizations to create and enforce a number of information governance initiatives.  

Layered on top of Retention Policies are Classification Labels. With Classification Labels, organizations can manually apply a specific information governance rule to content. The Classification Label sets can be published to different locations across the Office 365 platform.  

Classification Labels make it easy for users without deep knowledge or training to follow information governance policies. Apply a Classification Label of “External Proposal” to a new sales proposal, and the user is done.

Alternatively, Classification Labels can be defined and applied automatically and/or by default to a set of locations. 

Maybe your organization has a mergers and acquisitions group. The group can define and automatically apply a Classification Label for all of the content it creates, regardless of where it is stored. The added benefit of a Classification Label over a Retention Policy is the label actually manifests on the content, whether a document or email.

Retention Policies and Classification Labels give users the option to create global policies, which apply to all content in the platform or more specific policies, applied to very specific content in specific targeted locations. With this flexibility, organizations can solve many diverse and unique information governance challenges.

A Deeper Dive Into New Office 365 Governance Capabilities

Before jumping in with both feet, take a deeper look into these new features to ensure you obtain the results you expect.

Retention and Records

The new Advanced Data Governance (ADG) features introduce content retention as well as record declaration capabilities. 

Retention, as implemented in the ADG context, retains content for a specified period of time. The content remains accessible and behaves like any other content until the time of deletion. Users may continue editing, sharing and collaborating on it. 

When a content item is deleted, the ADG features manages the preservation of the content so that it is not lost.

Content marked as a "record" is handled differently than retained content. This unique Classification Label option prevents users from modifying the specific item in any way — a difference users will note during the normal course of work.

Deletion and Destruction

When content is no longer retained, the process becomes a delete action. Organizations may define the retention policy to do nothing at the end of retention, or perform a delete. Note that in this case delete doesn’t mean “delete immediately.” ADG uses the recycle bin to provide a staged deletion process. Therefore, “deleted” content may still exist and be accessible in the recycle bin for a period of time.

Microsoft announced plans to put an approval process in place for the retention policy, that will make creating more formal processes around information destruction possible.  

Date Calculations

Also in this release, ADG provides date options for the calculation of the retention period. It makes standard dates such as Created and Modified available as an option for when the content was labeled (in the case of Classification Labels).

No option currently exists to support custom date fields or event-driven (also known as retention triggers) retention. Expect these soon per Microsoft.

First Impressions

Through our involvement in the preview as a Microsoft independent software vendor and our work with several joint partners, we have some initial impressions of these new features.

Unified Policy Management: Microsoft has finally moved to unify policy management, a big plus because we no longer have to manage separate, application specific policies.

Application of Retention Policies and Classification Labels: This step was quite easy and operates through a very modern wizard, stepping even novices through the process.

Timeliness of Processes: In our experience, the policy application service level agreements aren’t immediate, some taking as long as seven days. As ADG gets wider adoption and Microsoft gains experience with the service, we believe these will come down.

Not Your Traditional Records Management: More traditional organizations using legacy records management solutions will require some adjustments to adapt to these new concepts. For some organizations, these capabilities will augment more regimented processes to address the ever-increasing proliferation of content and the risks it represents.

Terminology: Take your time and understand what each of these new features is doing. We found ourselves a little confused more than once with the use of terminology.

Enterprise Perspective: One of the biggest challenges we faced was understanding the what, when and where of the Retention Policies and Classification Labels.  Since each of these is a simple listing of defined policies and labels, it becomes very difficult to track where certain policies are applied and what labels are available.   We suggest starting with very broad definitions and picking relevant naming conventions (you can name and describe these any way you want). Microsoft is gathering feedback in this area, so we hope to see improvements in the future.

What About Other Sources: As stated previously, these capabilities mark a great step forward for Microsoft. If your organization has other locations or applications with policy requirements, you will need to look for solutions that extend the platform.

Microsoft deserves credit for listening to its clients and taking this leap forward. For those of us committed to the platform, we are happy to see these capabilities.  While adding some great capabilities, we believe organizations will find that some compliance requirements and information handling processes will require broader and deeper functionality in specific areas.