Proof of Disposal for Records in Microsoft 365

Some good work is happening in Microsoft to bring more robust capabilities to the Records Management solution in Microsoft 365. A common regulatory requirement for managing records and their destruction is inserting a review process prior to deletion and having a mechanism to provide proof of a record’s disposal (what was disposed, who did it, when was it done).

Up to this point in time, the proof was done by exporting a list of document names/details disposed of to a csv file and saving it in a secure location. This was largely a manual process and records managers needed to ensure this was done prior to the disposed record list being removed. (I can’t recall how long items in this list were retained prior – possibly 30 days?)

Fast forward to today and a new capability has been introduced called Proof of Disposal! This feature retains a list of disposed items across your tenant for 7 years. It includes the title, location, who deleted it, when it was deleted, and the (optional) deletion comment.

You will see this feature in action when you choose the Records Management menu option in the Compliance Centre and select the Disposition tab.

Note: in my experience, you have to be listed as a Disposition Reviewer before you will see any record labels in this list.

For a retention label to show in the Dispositions list, it must meet 1 of 2 criteria.

Criteria 1: retention label defined with the ‘Trigger a disposition review’ checkbox checked:

Criteria 2: retention label defined to declare document a record

In my tenant, I have 6 labels with the Disposition Review option set and 6 labels identified as ‘Records’ where 1 of the labels, RFX, is BOTH a record and requires disposition review.

This slideshow requires JavaScript.

When I select the Disposition tab for this tenant, 4 of the labels are going thru the disposition process. In the image below, 3 of the labels have some content up for disposition (RFI, Test Review Label, Legal Case File) identified with red stars and 1 record label identified with a yellow star has had 4 documents automatically disposed (Record3Days) since it doesn’t have a disposition review:

If you select a retention label that was a record that does not require disposition review, Record3Days for example, the tool will show all documents automatically deleted (by date range). These records will automatically go to their site’s second-stage recycle bin and follow normal recycle bin processing from that point.

If you select a retention label with pending dispositions, Legal Case File for example, it will show the documents requiring a disposition action, 5 in this case:

For each document, you can:

1. Dispose the document (The document will go directly to the second-stage recycle bin within its site and is therefore not discoverable by eDiscovery nor content search. It will follow normal recycle bin processing from this point)
2. Extend the retention for the document
3. Tag (apply a different retention label) the document

In all cases, the comment entered will be retained for each document and shown in the Disposed Items list. This list is also exportable if required.

This slideshow requires JavaScript.

There’s the proof!

The list of items shown in the Disposed Items tab are kept for up to 7 years after the item was disposed, with a limit of one million items per record for that period (if the count in your tenant is starting to approach 1 million for any one record, current instructions are to reach out to Microsoft support).

The retention of the disposed items list will definitely help Information Management teams have the proof of disposition they require for many regulations.

Thanks for reading.

-JCK

Credit: Photo by Agung Raharja on Unsplash