Disposition of content
Use the Disposition tab from Records Management in the Microsoft 365 compliance center to manage disposition reviews and view records that have been automatically deleted at the end of their retention period.
Prerequisites for viewing content dispositions
To manage disposition reviews and confirm that records have been deleted, you must have sufficient permissions and auditing must be enabled.
Permissions for disposition
To successfully access the Disposition tab in the Microsoft 365 compliance center, users must have the Disposition Management role and the View-Only Audit Logs role. Although the standard advice is to add users to the default role groups, in this case, we recommend you create a new role group called Disposition Reviewers that has these two roles and add users to this group as needed. A single role group for disposition reduces administration overheads and makes it easier for users have the combined permissions that they need.
Even a global admin needs to be granted the Disposition Management role. So if global admins need to access the disposition tab, them as members of the Disposition Reviewers role group.
Specific to the View-Only Audit Logs role:
Because the underlying cmdlet used to search the audit log is an Exchange Online cmdlet, you must assign users this role by using the Exchange admin center in Exchange Online, rather than by using the Permissions page in the Security & Compliance Center. For instructions, see Manage role groups in Exchange Online.
Microsoft 365 groups (formerly Office 365 groups) aren't supported for this role. Instead, assign user mailboxes, mail users, or mail-enabled security groups.
For instructions to grant users the Disposition Management role and create your new Disposition Reviewers role, see Give users access to the Office 365 Security & Compliance Center.
Make sure that auditing is enabled at least one day before the first disposition action. For more information, see Search the audit log in the Office 365 Security & Compliance Center.
When content reaches the end of its retention period, there are several reasons why you might want to review that content to decide whether it can be safely deleted ("disposed"). For example, you might need to:
Suspend the deletion of relevant content in the event of litigation or an audit.
Remove content from the disposition list to store in an archive, if that content has research or historical value.
Assign a different retention period to the content, perhaps because the original retention settings were a temporary or provisional solution.
Return the content to clients or transfer it to another organization.
When a disposition review is triggered at the end of the retention period:
The people you choose receive an email notification that they have content to review. These reviewers can be individual users, distribution or security groups, or Microsoft 365 groups (formerly Office 365 groups). Note that notifications are sent on a weekly basis.
The reviewers go to the Disposition tab in the Microsoft 365 compliance center to review the content and decide whether to permanently delete it, extend its retention period, or apply a different retention label.
A disposition review can include content in Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft 365 groups. Content awaiting a disposition review in those locations is deleted only after a reviewer chooses to permanently delete the content.
A mailbox must have at least 10 MB data to support disposition reviews.
You can see an overview of all pending dispositions in the Overview tab. For example:
When you select the View all pending dispositions, you're taken to the Disposition page. For example:
Workflow for a disposition review
The following diagram shows the basic workflow for a disposition review when a retention label is published and then manually applied by a user. Alternatively, a retention label configured for a disposition review can be auto-applied to content.
Triggering a disposition review at the end of the retention period is a configuration option that's available only with a retention label. This option is not available for a retention policy. For more information about these two retention solutions, see Learn about retention policies and retention labels.
When you select the option Notify these people when there are items ready to review, specify a user or mail-enabled security group. Microsoft 365 groups (formerly Office 365 groups) are not supported for this option.
Viewing and disposing of content
When a reviewer is notified by email that content is ready to review, they go to the Disposition tab from Records Management in the Microsoft 365 compliance center. The reviewers can see how many items for each retention label are awaiting disposition, and then select a retention label to see all content with that label.
After you select a retention label, you then see all pending dispositions for that label from the Pending disposition tab. Select one or more items where you can then choose an action and enter a justification comment:
As you can see from the picture, the actions supported are:
- Permanently delete the item
- Extend the retention period
- Apply a different retention label
Providing you have permissions to the location and the content, you can use the link in the Location column to view documents in their original location. During a disposition review, the content never moves from its original location, and it's never deleted until the reviewer chooses to do so.
The email notifications are sent automatically to reviewers on a weekly basis. This scheduled process means that when content reaches the end of its retention period, it might take up to seven days for reviewers to receive the email notification that content is awaiting disposition.
All disposition actions can be audited and the justification text entered by the reviewer is saved and displayed in the Comment column on the Disposed items page.
How long until disposed content is permanently deleted
Content awaiting a disposition review is deleted only after a reviewer chooses to permanently delete the content. When the reviewer chooses this option, the content in the SharePoint site or OneDrive account becomes eligible for the standard cleanup process described in How retention settings work with content in place.
Disposition of records
The rollout for proof of disposal for records in SharePoint and OneDrive is complete. You will see the list of retention labels that marked content as records for SharePoint and OneDrive in the Disposition section of the Records Management page in the Microsoft 365 compliance center. Under these labels, you can see the list of items in SharePoint and OneDrive that were disposed automatically or after a disposition review.
Proof of disposal for records in Exchange is not yet active. When this rollout begins and when it is complete, we will update this note.
Use the Disposition tab from the Records Management page to identify records that are automatically deleted. These items display Records Disposed in the Type column. For example:
Items that are shown in the Disposed Items tab for record labels are kept for up to seven years after the item was disposed, with a limit of one million items per record for that period. If you see the Count number nearing this limit of one million, and you need proof of disposition for your records, contact Microsoft Support.
Filter and export the views
When you select a retention label from the Disposition page, the Pending disposition tab (if applicable) and the Disposed items tab let you filter the views to help you more easily find items.
For pending dispositions, the time range is based on the expiration date. For disposed items, the time range is based on the deletion date.
You can export information about the items in either view as a .csv file that you can then sort and manage using Excel: