Microsoft 365 Roadmap ID: 562343
Data retention sounds simple.
Keep what you need.
Delete what you don’t.
Retain information for as long as regulations, policies and the business require.
In reality, it’s rarely that straightforward.
Most organisations have enormous amounts of information sitting across SharePoint and OneDrive. Some of it is sensitive. Some of it is business-critical. Some of it is old, duplicated or no longer required.
The challenge isn’t simply how to retain data.
It’s knowing what you should retain, why you should retain it, and for how long.
That’s where Microsoft Purview is heading with Roadmap ID 562343.
Microsoft is introducing new insights into sensitive Microsoft 365 data, together with recommendations for retention policies, helping organisations make more informed Data Lifecycle Management decisions.
👉 Retention shouldn’t be guesswork
One of the biggest problems with information governance is that retention policies can sometimes be created from assumptions.
For example:
“Let’s keep everything for seven years.”
It sounds safe.
But is it actually good governance?
Keeping everything indefinitely creates its own problems.
More data means:
- More storage
- More information to manage
- More information to discover
- More information that could be exposed
- More compliance complexity
- More unnecessary personal or sensitive data
The goal shouldn’t be maximum retention.
It should be appropriate retention.
👉 Turning sensitive data into an actionable insight
The interesting part of RM562343 is the focus on insights.
Rather than simply giving administrators another place to configure a retention policy, Microsoft is looking at the information already held within Microsoft 365 and helping organisations understand their sensitive data.
The roadmap specifically focuses on SharePoint and OneDrive.
That could help answer questions such as:
- Where is sensitive information being stored?
- How much sensitive information do we have?
- What information might require a retention policy?
- Where are our potential governance gaps?
- Are our current retention policies aligned with the data we actually hold?
That changes the conversation.
Instead of:
“What retention policy should we create?”
we can start with:
“What does our data tell us we need to protect and retain?”
👉 From data discovery to lifecycle management
This is where I think this capability becomes particularly interesting.
Organisations often have separate processes for:
Discovering sensitive information
and
Managing its lifecycle.
But those two activities should be connected.
If Purview identifies sensitive information, that insight can potentially help inform the next governance decision:
Should this information have a retention policy?
That creates a much more intelligent lifecycle:
Discover → Understand → Decide → Retain → Review → Dispose
And that’s exactly the direction I’d like to see information governance moving towards.
👉 It’s not about retaining everything
There is an important governance principle here.
Retention is not the same as preservation.
A good retention strategy should balance competing requirements.
For example:
Keep it
Because there’s a legal, regulatory or business requirement.
Keep it for a defined period
Because the information has a useful business or compliance lifecycle.
Review it
Because its value or risk may change over time.
Dispose of it
Because there is no longer a legitimate reason to retain it.
This is why better data insight matters.
You can’t make good lifecycle decisions if you don’t understand the information you’re managing.
👉 Why SharePoint and OneDrive matter
For many organisations, SharePoint and OneDrive have become the default locations for business information.
Documents are created, shared, collaborated on and increasingly consumed by AI.
That makes information governance even more important.
Sensitive information sitting in an old SharePoint site isn’t necessarily harmless simply because nobody has looked at it for several years.
It can still represent:
- Compliance risk
- Privacy risk
- Security risk
- Discovery risk
- AI exposure risk
Understanding where that information exists — and how long it should exist — is therefore becoming increasingly important.
👉 This could also help with AI governance
There’s another angle here that I think organisations should consider.
We’re now entering a world where AI can find and use organisational information at incredible speed.
That makes data lifecycle management part of AI governance.
If your organisation has thousands of old documents containing sensitive information, those documents may become increasingly relevant as AI capabilities expand.
So the question becomes:
Do we really want AI to be able to discover information simply because we’ve never deleted it?
That’s a very different way of thinking about retention.
Good lifecycle management isn’t just about satisfying regulatory requirements.
It can also help create a cleaner, safer and more governable data estate for AI.
👉 What should organisations do now?
Although RM562343 is still in development, I’d use this opportunity to review your current information lifecycle strategy.
1. Understand your sensitive data
Do you know where your sensitive information actually lives?
2. Review your retention policies
Are your policies based on business requirements and regulatory obligations — or simply historical decisions?
3. Identify old data
Look for information that may no longer have a legitimate reason to exist.
4. Connect classification and retention
Your classification strategy should help inform your lifecycle strategy.
5. Think about AI
Consider whether unnecessary historical information could create additional risk as AI adoption increases.
💡 The Jim Talks takeaway
For me, RM562343 isn’t simply another Purview feature.
It represents a move towards more intelligence in information lifecycle management.
We’re moving away from:
“Create a retention policy and hope it covers the right information.”
Towards:
“Understand our information first, then make better lifecycle decisions.”
That’s a much stronger governance model.
Because ultimately, good information governance isn’t about keeping everything.
It’s about keeping the right information, for the right reason, for the right amount of time – and confidently disposing of the rest.
Better insight should lead to better retention decisions.
And that’s why Roadmap ID 562343 is one worth watching.
Leave a Reply