Email Retention Policies in Exchange 2010

When Microsoft launched Exchange Server 2010, they touted the three pillars of its development: Flexible and Reliable; Anywhere Access; and Protection and Compliance. Today I'd like to take a look at the Protection and Compliance part of the picture—specifically, how you can implement email retention policies with Exchange 2010. But first a little background of what came before the Exchange 2010 method, and why the new system is a big improvement.

Earlier this year, Penton Media, Windows IT Pro's parent company, implemented an email retention policy based on managed custom folders in Exchange 2007. The basic policy is set up so that any email item is automatically deleted after six months unless a user moves it to one of a set of managed custom folders in the user's mailbox. Each custom folder has a specific retention length assigned to it ranging from 18 months to 8 years, corresponding to specific legal retention needs; items within a folder are automatically deleted when they reach that folder's retention length. One additional folder is labeled as Permanent and is used for items that need to be maintained indefinitely.

Related: Exchange 2010 Discovery Searches: What about users who leave?

So the system is set up and pushed out to end users by the IT department. You can read about the process the Penton IT department went through in "Establishing an Email Retention Policy: The IT Perspective." With a bit of training, it's not difficult for end-users to adhere to the policy and save the appropriate messages in the correct folders. However, the system is fairly rigid; end users have no ability to either override the policy in specific instances or customize it to meet personal workloads or workflows. With Exchange 2010, administrators can choose to change that situation.

First of all, in Exchange 2010, you no longer need managed custom folders, although they're still available. Retention policies can be applied to any folder. In fact, there are different types of policies for different situations. Most similar to managed custom folders is the Retention Policy Tag (RPT). This type can be applied to Outlook's default folders (e.g., Inbox, Deleted Items, Sent Items); they can't, however, be applied to the Calendar, Contacts, Journal, Notes, or Tasks default folders. For overall mailbox management, Exchange 2010 gives you the Default Policy Tag (DPT). Policies of this type apply to any mailbox items that don't have a retention policy in force because of the folder they're in or because a user has set a tag specific to the item.

That leads to the third type of policy, Personal Tags. Assuming administrators have enabled this functionality, end users can use Personal Tags to apply policies to individual mailbox items and to folders they create (though not to default folders, which are covered by RPTs). This ability is where end users can really customize email retention in their mailboxes.

The tags work together in a smart way. For instance, if you have a Personal Tag applied to a mail message so that it should be retained for three years, and you move the item into a project folder that has a retention time applied of one year, the system keeps the longer date on the individual item. Even better, when you open an item or view it in the Outlook Reading Pane, information about the item's current retention is clearly displayed for you at the top of the message.

Along with each of these tags, you set an action to apply when the age limit is reached. For instance, you can have the item moved to the new Exchange 2010 archive or moved to the Deleted Items folder. You could also have items clearly marked as over the retention limit to bring them to users' attention; this is a nice feature particularly if you're just implementing a retention policy. This method brings items to the attention of users so they know something must be done—and with luck, they'll do the right thing.

During a recent call with Windows IT Pro editors, Ian Hammeroff, senior technical product manager for Microsoft, demonstrated how easy it is to apply retention policies with Exchange 2010. "Our motivation about doing it this way is that it really allows users to use retention policies and archiving policies in a way that doesn't interrupt their workflow," he said. "In Exchange 2007, we had a total folder based approach where the IT department pushed down a set of custom folders or default folders and the users had to drag and drop their messages into these different folders, and that was the only policy that you could apply to that mail message. Here you can do all the customization and be very granular if you decide to do so."

When Penton introduced its Exchange 2007–based retention policy with managed folders, it seemed like a fairly slick technological solution to the problem of managing what to keep and what to delete from that ever-growing Inbox. However, the Exchange 2010 capabilities make what we have now seem about like an abacus compared to a modern computer. It's that kind of leap forward. You can read more about this feature in the Microsoft article "Understanding Retention Policies."

Related Reading: