Disposition of content

Microsoft 365 licensing guidance for security & compliance.

Use the Disposition page from Records Management in the Microsoft 365 compliance center to manage disposition reviews and view the metadata of records that have been automatically deleted at the end of their retention period.

Note

In preview: multi-stage disposition review

An administrator can now add up to five consecutive stages of disposition review in a retention label, and reviewers can add others users to their disposition review stage. You can also customize the email notifications and reminders. The following sections have more information about the changes in this preview.

To read the release announcement, see the blog post Announcing Multi-Stage Disposition in Microsoft Records Management.

Prerequisites for viewing content dispositions

To manage disposition reviews and confirm that records have been deleted, you must have sufficient permissions and auditing must be enabled. Also be aware of any limitations for disposition.

Permissions for disposition

To successfully access the Disposition tab in the Microsoft 365 compliance center, users must have the Disposition Management role. From December 2020, this role is now included in the Records Management default role group.

Note

By default, a global admin isn't granted the Disposition Management role.

To grant users just the permissions they need for disposition reviews without granting them permissions to view and configure other features for retention and records management, create a custom role group (for example, named "Disposition Reviewers") and grant this group the Disposition Management role.

For instructions to configure these permissions, see Give users access to the Office 365 Security & Compliance Center.

Additionally:

  • To view the contents of items during the disposition process, add users to the Content Explorer Content Viewer role group. If users don't have the permissions from this role group, they can still select a disposition review action to complete the disposition review, but must do so without being able to view the item's contents from the mini-preview pane in the compliance center.

  • In preview: By default, each person that accesses the Disposition page sees only items that they are assigned to review. For a records management administrator to see all items assigned to all users, and all retention labels that are configured for disposition review: Navigate to Records management settings > General > Security group for records manager to select and then enable a mail-enabled security group that contains the administrator accounts.

    Microsoft 365 groups and security groups that aren't mail-enabled doesn't support this feature and wouldn't be displayed in the list to select. If you need to create a new mail-enabled security group, use the link to the Microsoft 365 admin center to create the new group.

    Important

    After you have enabled the group, you can't change it in the compliance center. See the next section for how to enable a different group by using PowerShell.

  • In preview: The Records management settings option is visible only to record management administrators.

Enabling another security group for disposition

After you have enabled a security group for disposition from the Records management settings in the Microsoft 365 compliance center, you can't disable this permission for the group or replace the selected group in the compliance center. However, you can enable another mail-enabled security group by using the Enable-ComplianceTagStorage cmdlet.

For example:

Enable-ComplianceTagStorage -RecordsManagementSecurityGroupEmail dispositionreviewers@contosoi.com

Enable auditing

Make sure that auditing is enabled at least one day before the first disposition action. For more information, see Search the audit log in the Office 365 Security & Compliance Center.

Disposition reviews

When content reaches the end of its retention period, there are several reasons why you might want to review that content and confirm whether it can be permanently deleted ("disposed"). For example, instead of deleting the content, you might need to:

  • Suspend the deletion of relevant content for litigation or an audit.

  • Assign a different retention period to the content, perhaps because the original retention settings were a temporary or provisional solution.

  • Move the content from its existing location to an archive location, for example, if that content has research or historical value.

When a disposition review is triggered at the end of the retention period:

  • The reviewers you choose receive an email notification that they have content to review. These reviewers can be individual users or mail-enabled security groups. New in preview:
    • You can customize the email that they receive, including instructions in different languages. For multi-language support, you must specify the translations yourself and this custom text is displayed to all reviewers irrespective of their locale.
    • Users receive an initial email notification per label at the end of the item's retention period, with a reminder per label once a week of all disposition reviews that they are assigned. They can click the link in the notification and reminder emails to go to the Disposition page in the Microsoft 365 compliance center to review the content and take an action. Alternately, the reviewers can go directly to the Disposition page in the compliance center.
    • Reviewers see only the disposition reviews that are assigned to them, whereas administrators who are added to the selected security group for records manager see all disposition reviews.
    • Reviewers can add new users to the same disposition review. Currently, this action doesn't automatically grant these added users the required permissions.
    • For the disposition review process, a mini-review pane for each item shows a preview of the content if they have permissions to see it. If they don't have permissions, they can select the content link and request permissions. This mini-review pane also has tabs for additional information about the content:
      • Details to display indexed properties, where it's located, who created it and when, and who last modified it and when.
      • History that shows the history of any disposition review actions to date, with reviewer comments if available.

A disposition review can include content in Exchange mailboxes, SharePoint sites, and OneDrive accounts. Content pending a disposition review in those locations is permanently deleted only after a reviewer for the final stage of disposition chooses to permanently delete the content.

Note

A mailbox must have at least 10 MB data to support disposition reviews.

Administrators can see an overview of all pending dispositions in the Overview tab. Reviewers see only their items pending disposition. For example:

Pending dispositions in Records management overview

When you select the View all pending dispositions, you're taken to the Disposition page. For example:

Dispositions page in Microsoft 365 compliance center

Workflow for a disposition review

The following diagram shows the basic workflow for a disposition review when a retention label is published and then manually applied by a user. Alternatively, a retention label configured for a disposition review can be automatically applied to content.

Chart showing flow of how disposition works

How to configure a retention label for disposition review

Triggering a disposition review at the end of the retention period is a configuration option that's available only with a retention label. Disposition review is not available for a retention policy. For more information about these two retention solutions, see Learn about retention policies and retention labels.

From the Define retention settings page for a retention label:

Retention settings for a label

After you select this Trigger a disposition review option, on the next page of the wizard, you specify how many consecutive stages of disposition you want and the disposition reviewers for each stage:

Specifying disposition reviewers

Select Add a stage, and name your stage for identification purposes. Then specify the reviewers for that stage.

For the reviewers, specify a user or a mail-enabled security group. Microsoft 365 groups (formerly Office 365 groups) are currently not supported for this option.

If you need more than one person to review an item at the end of its retention period, select Add a stage again and repeat the configuration process for the number of stages that you need, with a maximum of five stages.

Within each individual stage of disposition, any of the users you specify for that stage are authorized to take the next action for the item at the end of its retention period. These users can also add other users to their disposition review stage.

Note

Existing retention labels that are configured for disposition review can be upgraded to use multi-staged disposition review by configuring the label. In the label wizard, select Add a stage, or edit the existing reviewers or add new reviewers.

During the configuration phase, for each stage specified, you can rename it, reorder it, or remove it by selecting the Stage actions option (...):

Stage actions for disposition reviews

However, you can't reorder or remove a stage after you have created the retention label.

After you have specified your reviewers, remember to grant them the Disposition Management role permission. For more information, see the Permissions for disposition section on this page.

How to customize email messages for disposition review

Example default email notification sent to a reviewer:

Email notification example with default text when an item is ready for disposition review

Also in preview, you can customize the email messages that are sent to disposition reviewers for the initial notification and then reminders.

From any of the Disposition pages in the compliance center, select Records management settings:

Records management settings

Then select the Disposition notifications tab, and specify whether you want to use just the default email message, or add your own text to the default message. Your custom text is added to the email instructions after the information about the retention label and before the next steps instructions.

Text for all languages can be added, but formatting and images are currently unsupported. URLs and email addresses can be entered as text and depending on the email client, display as hyperlinks or unformatted text in the customized email.

Example text to add:

If you need additional information, visit the helpdesk website (https://support.contoso.com) or send them an email (helpdesk@contoso.com).

Select Save to save any changes.

Viewing and disposing of content

When a reviewer is notified by email that content is ready to review, they can click a link in the email that takes them directly to the Disposition page from Records management in the Microsoft 365 compliance center. There, the reviewers can see how many items for each retention label are waiting disposition with the Type displaying Pending disposition. They then select a retention label, and Open in new window to see all content with that label:

Open in new window for disposition review

From the Pending dispositions page, they see all pending dispositions for that label. When one or more items are selected, they can use the mini-preview pane and the Source, Details, and History tab to inspect the content before taking action on it:

Disposition options

If you use the horizontal scroll bar, or close the min-review pane, you see more columns that include the expiry date and the name of the disposition review stage.

As you can see from the example shown, the actions supported are:

  • Approve disposal:

    • When this action is selected for an interim stage of disposition review (you have configured multiple stages): The item moves to the next disposition stage.
    • When this action is selected for the final stage of disposition review, or there is only one stage of disposition: The item is marked as eligible for permanent deletion. The exact timing for that deletion depends on the workload. For more information, see How retention settings work with content in place.
  • Relabel:

    • When this action is selected, the item exits the disposition review process for the original label. The item is then subject to the retention settings of the newly selected retention label.
  • Extend:

    • When this action is selected, disposition review is effectively suspended until the end of the extended period and then disposition review is triggered again from the first stage.
  • Add reviewers:

    • When this action is selected, the user is prompted to specify and add other users for review.

    Note

    This action doesn't automatically grant the required permissions to the users who are added. If they don't have these permissions, they won't be able to participate in the disposition review.

Each action taken is saved and stored although you can't yet search for them in the audit log.

During a disposition review, the content never moves from its original location, and it's not marked for permanent deletion until this action is selected by a reviewer for the final or only disposition stage.

Disposition of records

Use the Disposition tab from the Records management page to identify:

  • Items deleted as a result of a disposition review.
  • Items marked as a record or regulatory record that were automatically deleted at the end of their retention period.

These items display Records Disposed in the Type column. For example:

Items that were disposed of without a disposition review

Note

This functionality uses information from the unified audit log and therefore requires auditing to be enabled and searchable so the corresponding events are captured.

For auditing of deleted items that were marked as records or regulatory records, search for Deleted file marked as a record in the File and page activities category. This audit event is applicable to documents and emails.

Filter and export the views

When you select a retention label from the Disposition page, the Pending disposition tab (if applicable) and the Disposed items tab let you filter the views to help you more easily find items.

For pending dispositions, the time range is based on the expiration date. For disposed items, the time range is based on the deletion date.

You can export information about the items in either view as a .csv file that you can then sort and manage using Excel.