Most businesses either delete email too aggressively or keep everything forever. Both are wrong. A simple, practical retention policy — and how to set it up in Microsoft 365.
Most businesses take one of two approaches to old email, and both are wrong. They either delete everything to save space, or they keep everything forever because they might need it someday.
The first loses you a dispute you'll wish you'd won. The second quietly turns your mailbox into a legal and security liability. Here's a middle path that actually works.
Why keeping matters
Email is, for most businesses, the primary record of agreements, decisions, and instructions. When a contract dispute, a customer complaint, or an employment question arises, the email thread is usually the evidence.
Delete it too aggressively, and you lose the ability to defend yourself. In regulated industries — finance, healthcare, legal — deleting records you're required to keep isn't just inconvenient; it's a compliance failure with real consequences.
Why keeping everything is also a problem
The instinct to keep everything is understandable, but it carries costs people don't see:
- Storage cost. Mailboxes balloon, and the storage you're paying for climbs with them.
- Risk surface. Every old email with sensitive data is a record a breach could expose. More email, more exposure.
- Discovery pain. When you actually need to find one thread, searching ten years of clutter slows you down — and in a legal matter, that's billable time.
- Retention obligations cut both ways. In some cases, keeping records longer than required is itself a problem.
A simple retention policy
You don't need a 40-page legal document. A workable policy answers three questions:
- What must we keep, and for how long? (Often: financial records 7 years, employment records per regulation, contracts for the life of the agreement plus a few years.)
- What can we delete, and when? (Routine correspondence can usually go after 1–3 years.)
- Where does kept email live? (In an archive, not in someone's active mailbox.)
The goal isn't to keep everything or nothing. It's to keep the right things, for the right time, in the right place.
What Microsoft 365 gives you for free
Most businesses already own the tools for this and don't use them. Microsoft 365 includes retention policies and labels that automate the decision:
- Retention policies keep items for a set period and delete them after.
- Labels let users mark sensitive threads that deserve longer keeping.
- Archiving moves old mail out of the active mailbox into a searchable archive.
Set once, it works in the background — no one has to remember to file or delete anything.
The one thing not to do
Don't let individuals decide their own retention by deleting what "feels" old. That's how the one thread you need turns out to be the one someone cleaned up last spring.
Retention should be a policy, not a personal habit.
Want help setting up Microsoft 365 retention without overcomplicating it? Book a strategy call and we'll configure it properly.