RUN-PUR-001 / SOURCE CONTROLLED
Purview protection and retention decision table
Use when a Microsoft 365 file or email cannot be accessed, changed or permanently deleted as expected and more than one Purview control may apply.
Control decision table
| CONTROL | QUESTION | ITEM EVIDENCE | CHANGE AUTHORITY |
|---|---|---|---|
| Sensitivity label | Who may open, share or alter it? | Label ID/name, encryption, markings, application event | Information protection |
| Container sensitivity | How is the site/group boundary protected? | Site label, sharing, privacy, unmanaged-device settings | Workspace/security owner |
| Retention policy | Which location-level lifecycle applies? | Policy lookup, scope, retain/delete actions, start basis | Records/compliance |
| Retention label | Which explicit item lifecycle applies? | Label, method, period, trigger, end action, record status | Records/compliance |
| eDiscovery hold | Must the item remain for a case? | Authorised case confirmation and applicable location/item | Legal/eDiscovery |
| Preservation Lock | Can policy be weakened or disabled? | Locked policy state and original approval | Governance/legal |
Lifecycle calculation
- List every retain action and calculate its item-specific end date.
- Apply holds: content remains preserved while an applicable hold exists.
- Retention takes precedence over permanent deletion.
- The longest effective retention period wins.
- For remaining deletion conflicts, explicit item-level label deletion precedes policy deletion.
- For policy-only deletion conflicts, apply Microsoft’s scope and shortest-period rules.
- Record the predicted user-visible state and permanent-deletion state separately.
Required evidence record
- Exact workload, tenant, site/mailbox, item URL/ID and version.
- Request, reason, owner, authority and time boundary.
- Sensitivity and container-label configuration.
- Retention policy lookup and item retention label.
- Use the configured start trigger and calculated dates. Discard label-name assumptions.
- Record/regulatory-record lock state, disposition and hold status.
- Audit events, propagation allowance, test results and approved change.
Acceptance test pack
| PERSONA / ITEM | POSITIVE ASSERTION | NEGATIVE ASSERTION |
|---|---|---|
| Authorised worker | Can perform approved work | Cannot weaken lifecycle implicitly |
| External/unmanaged persona | Receives only approved access | Cannot bypass sensitivity protection |
| Ordinary working file | Follows site/default rule | Is not accidentally a record |
| Declared record | Shows correct period and end action | Cannot be casually relabelled/deleted |
| Overlapping controls | Outcome matches calculated precedence | UI disappearance is not logged as permanent deletion |
| Disposition item | Routes to authorised review | Does not dispose before final authority |
Change and rollback gate
Test future policy changes on synthetic content and a bounded scope. Capture before/after policy exports, expected propagation, item queries and audit events. Separate remediation of previously labelled content from the future default. Never use tenant exclusion, label deletion, record unlock or priority cleanup as an exploratory diagnostic. Roll back only where the control supports it and rollback does not breach a preservation obligation.
Limits and review
This runbook does not determine legal retention periods, authorise hold release, or prove permanent deletion from every replicated service. Microsoft 365 workload behavior, licensing and propagation windows change; review linked sources monthly and this control quarterly. Escalate regulatory records, Preservation Lock, eDiscovery holds and exceptional cleanup to the named authorities before change.