This is an anecdotal story about a SharePoint migration for a regulated organization and some unintended, yet predictable consequences they experienced with some of their migrated legacy content.
I recently wrote a post about Back-dating Retention in Microsoft 365 where I showed how migrated content that is at various points within the retention period can have its correct point-in-time retention clock set. (E.g., content created 7 years ago with a 10-year retention only has 3 years remaining to be retained before it can be disposed so we want its “clock” to be set at 7 years)
True story: I was working with a customer that had migrated their department network shares into SharePoint Online and had chosen to default the retention label on (some of) the content. They had also chosen to retain the created date during the migration, a common feature of most migration tools. This content was old… really old. The configuration for the retention label applied was to retain for 7 years past created date and delete with disposition review.
As expected, not long after the migration was completed (and once the back-end retention processes had time to run), approximately 14,000 items showed up in the disposition review Pending items tab – exactly the number of items migrated in from the network shares older than 7 years.
This is where the automated world of disposition hits home. It did exactly what it was told to do. In this case, the customer was not prepared for the new world of automated disposition review and were forced to dive in head first.
What’s the takeaway?
Some things to consider if you are planning on migrating content into SharePoint that may be beyond its retention period:
- Assess the content you want to migrate and seek to understand the age of items being migrated in. This is important.
- If the content has already reached its retention duration (I.e., “expired”), why are you migrating it? Can you defensibly dispose of it prior to migration? (This may save you significant time while still allowing you to be compliant)
- If you must migrate it, do you have your processes in place for disposition review in your organization if you require review before permanent destruction? E.g., Have disposition reviewers been assigned and trained for the content? Have disposition permissions been assigned appropriately? What’s the certificate of destruction requirements and steps to comply?
Disposition Review is one of those regulatory processes in an organization that requires awareness, governance, guidance for the disposition reviewers and an overall process to be compliant. It’s so much more than the tech.
Plan ahead. #lessonsfromthefield
Thanks for reading.