Your business’s email history — years of decisions, commitments, negotiations, and evidence — is currently governed by a retention policy. You just probably didn’t choose it: it’s whatever the platform’s defaults and individual deletion habits add up to, which means some mailboxes keep everything since 2014 while others auto-purge at whatever setting someone clicked once. Email is simultaneously a business record, a discovery target, and a breach surface — three reasons its retention deserves a decision rather than a default. Here’s the decision, and how to configure it.
The real tradeoff (both directions have teeth)
Keeping everything forever feels safe and carries costs: every retained email is discoverable in litigation (your own archive routinely does more work for opposing counsel than for you), a compromised mailbox exposes its entire history — ten years of attachments and secrets rather than ten months — and old mail full of personal data is breach surface with no business value. Deleting aggressively has the opposite teeth: the contract dispute where the deciding thread is gone, the regulator or client asking for records you purged, the institutional memory that left with the auto-delete. The working answer for most businesses is neither pole: a deliberate multi-year window — long enough for business-record and dispute realities (several years is a common landing zone), short enough that the archive isn’t an eternal liability — with the floors and exceptions below carved out explicitly. The number itself is a records-retention decision that belongs to counsel and your industry’s rules, not to a blog or a default.
The floors and the freeze
Two overrides shape any policy. Regulatory floors: financial firms’ communication-retention rules, healthcare’s record obligations where email touches PHI, firms’ matter-file duties — where a regime names email retention, its number wins, and the policy’s job is encoding it per affected mailbox or content type. Litigation hold: actual or reasonably anticipated litigation freezes deletion for relevant custodians, overriding everything — Microsoft 365’s hold machinery exists precisely for this, and the policy needs the trigger sentence in bold: possible litigation → counsel is called before anything else happens, because deletion-on-schedule during a hold window is how routine housekeeping becomes spoliation.
Configuring it (the mechanics are the easy part)
In Microsoft 365, the retention machinery turns the decision into enforcement: retention policies applying keep-then-delete windows automatically, org-wide or scoped (executives, finance, and regulated roles can carry longer windows than the general population — tiering works here as everywhere), litigation holds per custodian, and the whole thing operating invisibly beneath users’ ordinary deleting and filing. Three configuration notes from the field: retention ≠ backup — the policy governs the record; independent backup still covers the recovery scenarios, and the two windows should be set knowingly, together · departed employees’ mail follows the policy too — the preserve-then-deprovision step hands the mailbox to the retention regime rather than the 30-day deletion countdown · and tell the team the one behavioral rule: business conducted over personal email or unarchived channels sits outside everything just configured — the policy protects what flows through the system, which is the argument for keeping business communication in it.
The bottom line
Email retention is a decision your business is making right now by default — and the deliberate version fits in a paragraph: a counsel-informed window for the general population, longer tiers where roles and regulations demand, litigation holds with a bolded trigger, enforcement configured in the platform rather than delegated to habits, and offboarding wired to hand mailboxes into the regime. An afternoon of configuration against years of accumulating either liability or gaps — choose the window on purpose, and let the machinery keep the choice true.