How to Configure Custom Retention Policies, eDiscovery Holds, and DLP Rules in Microsoft Teams

Modern enterprise collaboration in Microsoft Teams generates continuous streams of persistent chat records, ephemeral meeting notes, shared files, and recorded media. While instant messaging drives velocity across distributed teams, unchecked communications pose severe legal and compliance vulnerabilities. Organizations must satisfy legal discovery mandates, retain regulatory records, prevent data exfiltration of intellectual property or Personally Identifiable Information (PII), and systematically purge obsolete conversations to minimize legal exposure.

Governing Microsoft Teams communications requires integrating capabilities across the Microsoft Purview compliance platform: Retention Policies for automated data lifecycles, eDiscovery (Standard and Premium) for litigation holds and legal export, and Data Loss Prevention (DLP) for real-time inspection and message blocking. Because Teams messages are architecturally split between Azure Cosmos DB chat storage and underlying Exchange Online / SharePoint Online storage engines, configuring governance policies incorrectly can result in catastrophic compliance oversights or unexpected data loss. This guide details how to configure Retention Policies, enact eDiscovery holds, and deploy DLP inspection rules across Microsoft Teams.

Architectural Overview: Microsoft Teams Data Substrates & Compliance Engines

Unlike monolithic applications, Microsoft Teams distributes data across several discrete storage services. Understanding where each artifact resides is critical for applying accurate Purview policies:

Teams Data Type	Primary Operational Store	Compliance Substrate Store	Applicable Purview Policy Mechanism
1:1 & Group Chat Messages	Azure Cosmos DB (Teams Chat Service)	Exchange Online (Hidden user mailbox folders)	Teams Retention Policy (Exchange Mailbox Compliance Engine)
Standard Channel Messages	Azure Cosmos DB	Exchange Online (Group mailbox folder)	Teams Channel Retention Policy
Private Channel Messages	Azure Cosmos DB	Exchange Online (Individual member mailboxes)	Dedicated Private Channel Retention Policy
Channel Shared Files	SharePoint Online Team Site Document Library	SharePoint Document Library	SharePoint Retention / DLP Policies
1:1 Chat Shared Files	Sender’s OneDrive for Business	OneDrive Document Library	OneDrive Retention / DLP Policies

Prerequisites and Environment Verification

• Licensing Requirements: Basic Retention and eDiscovery Standard require Microsoft 365 E3 / Business Premium. Advanced DLP for Teams and eDiscovery Premium require Microsoft 365 E5 or E5 Compliance add-ons.
• Administrative Roles: Compliance Administrator, eDiscovery Manager, or Global Administrator assigned inside the Microsoft Purview portal (https://purview.microsoft.com).
• PowerShell Module: Exchange Online Management PowerShell module v3.0+ installed for automated tenant queries.

Step 1: Configuring Custom Teams Retention Policies

Retention policies enforce either the mandatory preservation of messages for legal duration or the automated destruction of chat history after a specified timeframe.

1. Navigate to the Microsoft Purview compliance portal and select Data lifecycle management → Microsoft 365 → Retention policies.
2. Click New retention policy.
3. Provide a descriptive name (e.g., Teams Chat 1-Year Retention & Auto-Purge).
4. Under Policy Scope, select Static (for explicit targets) or Adaptive (dynamically binds based on Microsoft Entra ID department attributes).
5. Under Choose locations, toggle the standard locations off, and selectively enable:
   • Teams channel messages: Confines policies to team conversations.
   • Teams chats: Confines policies to 1:1, group chats, and meeting chats.
   • Teams private channel messages: Governs restricted private channels.
6. Configure the retention lifecycle under Decide if you want to retain content, delete it, or both:
   • Retain items for a specific period: Select the duration (e.g., 1 Year or 7 Years). Choose whether the timer starts from When it was created.
   • At the end of retention period: Select Delete items automatically.
   • Alternatively (Minimal Exposure): Select Only delete items when they reach a certain age (e.g., Purge 1:1 chats after 90 days).
7. Review configuration summaries and click Submit. Note that policy propagation across distributed Teams chat clusters takes up to 24 hours.

Step 2: Enacting eDiscovery Holds for Active Litigation

When an organization receives a subpoena or initiates internal investigations, an eDiscovery Hold freezes content immutably, overriding any automated deletion policies:

1. In Microsoft Purview, expand eDiscovery and click Standard (or Cases).
2. Click Create a case, enter a matter name (e.g., Litigation Hold - Project Alpha), and click Save.
3. Open the case and navigate to the Holds tab.
4. Click + Create to launch the hold wizard.
5. Assign a name (e.g., Custodian Hold - Exec Team).
6. Under Choose locations, select the specific custodians under investigation:
   • Add user mailboxes (which automatically captures 1:1 and group Teams chats).
   • Add specific Microsoft 365 Teams groups (which captures channel messages and SharePoint libraries).
7. (Optional) Define conditions using Keyword Query Language (KQL), such as restricting the hold strictly to messages matching "acquisition" OR "proprietary". Leaving conditions blank preserves all communications.
8. Click Submit → Done. Content is now locked in hidden Purview Substrate tables even if users hit “Delete message” in Teams.

Step 3: Creating Real-Time Data Loss Prevention (DLP) Rules

Teams DLP scans outbound messages and shared files in real time, preventing employees from leaking sensitive financial numbers, passwords, or patient medical records:

1. In Microsoft Purview, navigate to Data loss prevention → Policies → Create policy.
2. Select Custom policy → Next.
3. Provide a name: Teams Financial & PII Outbound Blocker.
4. Under Locations to apply policy, ensure Teams chat and channel messages is toggled On.
5. Click Create rule under the Advanced DLP rules screen.
6. Define Conditions:
   • Click + Add condition → Content contains → Sensitive info types.
   • Select Credit Card Number, EU Debit Card Number, and U.K. National Insurance Number.
   • Add second condition: Content is shared from Microsoft 365 → Select with people outside my organization (or inside).
7. Define Actions:
   • Under Actions, select Block access or restrict permissions on the content.
   • Choose: Block everyone or Block only people outside your organization.
8. Configure User Notifications: Check Notify users in Office 365 services with a policy tip. Customize the explanation to educate staff on compliant sharing.
9. Save the rule, set policy state to Turn it on immediately, and submit.

Purview Governance Policy Matrix for Microsoft Teams

Governance Capability	Enforcement Point	User Visibility	Latency to Activation
Chat Retention Auto-Purge	Server-side Substrate Sweeper	Silent deletion from user chat UI	24 to 48 hours for global propagation
eDiscovery Litigation Hold	Immutable Recoverable Items Store	Completely invisible to end user	Under 60 minutes
Data Loss Prevention (DLP)	Real-time message routing hook	Immediate red placeholder: “This message was blocked”	Real-time (milliseconds per message)

Auditing and Testing Policies via PowerShell

Systems engineers can audit active Purview policies programmatically using Exchange Online Management PowerShell:

# Connect to Security & Compliance Center PowerShell
Connect-IPPSSession -UserPrincipalName [email protected]

# Enumerate all active Teams retention policies
Get-RetentionCompliancePolicy | Where-Object { $_.TeamsChatLocation -ne $null -or $_.TeamsChannelLocation -ne $null } | Select-Object Name, Mode, Enabled

# Inspect active eDiscovery holds
Get-CaseHoldPolicy | Select-Object Name, CaseId, ExchangeLocation

Troubleshooting Common Teams Compliance Conflicts

Issue 1: Teams Messages Reappear After Retention Policy Purge

Root Cause: Client-side caching in local desktop Teams desktop cache (%appdata%\Microsoft\Teams or WebView2 cache) holds messages locally despite server-side mailbox substrate deletion.

Remediation: Instruct users to sign out of Teams and sign back in, or purge the local WebView2 cache folder located under %localappdata%\Packages\MSTeams_8wekyb3d8bbwe\LocalCache.

Issue 2: DLP Rule Blocks Legitimate Internal Development URLs

Root Cause: High sensitivity type heuristics falsely flag internal token strings or API test payloads as credit card or banking numbers.

Remediation: Navigate to the DLP rule in Purview, open the Sensitive Information Type definition, raise the confidence threshold from Low to High Confidence (85%+), and configure a character proximity match requiring surrounding keywords (such as “card”, “exp”, or “CVV”).

Issue 3: Retention Policy Fails to Delete Files Shared in Channels

Root Cause: Teams Chat & Channel Retention policies govern conversation text strings exclusively. Files shared in channels reside in SharePoint Online libraries and require an independent SharePoint Retention policy.

Remediation: Create a corresponding retention policy targeting the SharePoint sites location in Purview to match the retention schedule enforced on chat messages.