If your organization is using the Security & Compliance retention labels to apply retention across Office 365 workloads, you may eventually find yourself needing to remove an existing label definition for one reason or another. Perhaps you had a label set up for a test scenario and now want to remove it, or maybe the Information Management team changed their mind on the retention label configuration and want some labels to be removed. This is real-world, it happens.
This post is NOT referring to Azure Information Protection labels. Deleting them is a completely different process.
This post is referring to removing a label definition from the Security & Compliance Center, NOT removing a label from a document.
Although deleting a label definition sounds like a trivial thing to do, depending on your exact scenario, the behavior can be a little confusing. As an administrator, you need to understand it.
Official link from Microsoft: Delete retention labels
Warning: Neither an event-based retention label nor a regulatory record label can be deleted. Period.
Scenarios
- You’ve created the label and haven’t published it in a policy yet
- You’ve created the label, published it in a policy, but haven’t applied it to content yet
- You’ve created the label, published it in a policy, and applied it to content
- Special mention: above but with a RECORD label
I’ll go thru each of these scenarios and conclude with my recommendation for removing retention labels. 🙂
Scenario 1: Created a label, not yet published
The first scenario is the simplest to address. Any retention label not yet published will have a status of “Inactive”. Simply edit the label and select the Delete label option. No fuss, no muss. (UNLESS the label declared content as a record – for this, check out scenario 4)
Note: if you do delete a label like this, it takes a while for it to be completely removed from the system. If you try to immediately recreate a label with the same name, it will throw an error saying the label already exists. My testing has shown it takes ~1 day for it to be completely removed.
Scenario 2: Created a label, published it, but not used on content
I’ve created a label called Joanne Label 1 and included it in a Retention policy published to all locations in my tenant.
If you try to delete the label directly thru the UI (Classifications section in the Security & Compliance Center) or via PowerShell with the Remove-ComplianceTag cmdlet, you will get the error message(s) below:
Note: for these cmdlets, connect to the Security & Compliance Center. Instructions
You receive this error because the label is part of a retention policy and even though I haven’t applied the label to any content yet, it is technically “in-use”. It is a 2-step process to delete it.
Step 1: Remove the label from the policy OR delete the policy if the label was the only one in the policy
Thru the User interface:
With PowerShell:
Scenario 3: Created a label, published it, applied it to content
[UPDATE July 7, 2022] The updated documentation from Microsoft (Delete retention labels) has changed this behavior. According to documentation, you cannot delete a retention label (non-record) if it has been applied to content anywhere across your tenant. My testing has shown that you can. I will retest and update this post when I have reverified results. The takeaway… if your experience is different than what I’m showing here, then your tenant has the updated code as documented in the link. Also, thanks to a reader, there is a delay between when you remove the label off content and when you will be allowed to delete the retention label.
[This to be verified again…] To demonstrate this scenario, I’ve created a label, Joanne Label 1, published to all locations across my tenant, and uploaded some documents into a library on a modern team site, Label Test Site. I’ve applied the label to 3 documents.
If I try to delete the retention label, I will receive the same error as described in Scenario 2 above. I need to go thru the same steps to remove it:
Step 1: Remove the label from the policy OR delete the policy if the label was the only one in the policy.
Step 2: Remove the label either thru the UI or with PowerShell
But wait! What does this mean for content that has the label applied? Nothing for the time being… the label goes into a Pending Deletion state. Although for a time, existing content will retain the retention label applied, it will eventually be removed by a timer process running in the background. This process will clear the retention label from any content that had it applied. For testing I’ve done, this process can take several hours to complete.
You can confirm this by doing a Content search in the Security & Compliance Center filtering on the Compliance tag and the label you’re wanting to remove (image). (Reference: Where’s my Office 365 Retention Label applied?)
By searching across All Locations, you can find out exactly where the label was applied. (Exchange email, SharePoint sites, OneDrive accounts, Office 365 groups)
It may take several hours, but eventually the timer process will clear the retention label from any content it was applied to and the search query will return 0 results.
Scenario 4: Created a RECORD label
Recent changes now allow you to delete a RECORD retention label (checkbox below when you’re creating the retention label) after it’s created UNLESS it has been applied to content. Previously, this was not possible. Similar to a regular retention label, you can now delete it if it has not been published or auto-applied in a label policy.
If you no longer wish to use the record label for new content, remove it from the retention policy(s) it’s published in. This will remove it from the Apply label dropdown in the UI for end-users, however existing content with the label applied will remain intact.
My Recommendation
It’s important to understand where a retention label is being used across Office 365 locations BEFORE deleting it. The best way to do this is using the Content Search feature or Data Classification feature in the Microsoft Purview Compliance Center.
Based on your retention requirements, you can either allow the Timer process to complete and clear the retention label you want deleted or, based on the search results, proactively apply a different label prior to deleting it.
Thanks for reading.
-JCK
Credit: Photo by Matija Mestrovic on Unsplash