Governance in IT is establishing rules, policies, tools and practices that helps you manage and protect your enterprise resources. SharePoint governance (or wider – Collaboration governance) covers
Sometimes, mostly during PoC or testing policies like retention policy or lifecycle policy you would need some documents created and updated weeks, months or even years ago.
But if you create or upload a document in SharePoint library – it will be just a regular new document. So, how to get old documents in the new environment?
I see two options:
Adaptive scopes are good, but what if both policies are implemented? Which one wins?
The scenario for two policies might be: static retention policy is implemented as default retention policy for all sites, and if site require different retention or deletion – it should fall under one of the adaptive scopes and an adaptive retention policy will be applied.
This post is dedicated to one specific subject: implementing Microsoft 365 groups lifecycle (expiration) policy in large Microsoft 365 environments.
But this post is also a part of a bigger problem – dealing with ownerless resources in Large Microsoft 365 environments. Please refer to the umbrella post.
You administer a large Microsoft 365 environment. Let say you have 100k users or more, 50K or more sites. Environment is not new, so after some years you have a lot of ownerless groups and sites (thousands probably), and a lot of inactive groups and sites (probably tens of thousands). You are getting more and more ownerless groups – hundreds each month. You are thinking of stopping bleeding and cleaning this up…
If you are thinking of activating in an existing environment – you would probably have a spike – all the old groups will be subject to policy. The ide is to avoid situation when a specific person – group owner will get dozens of email. It would be better if a person will receieve, let say one email per week.
Here is my 4 possible approaches to avoid this spike, distribute notifications evenly across the time and ease the pain:
You would need to change the policy every, e.g. week, specifying different group lifetime in days period. Consider
– calculate number of days between the oldest group created an today, plus 35 days – it’ll be your first “group lifetime”
– activate the policy with this number of days in “group lifetime” – and within a week you will get notifications on the oldest group/groups
– after a week or two – change the “group lifetime” decreasing it by e.g. 30-60 days and reactivate the policy… and so on
You can easily calculate it all and choose your pace depending on how many groups you have to renew, how much time you need to clean-up. You got the idea.
Downside – in the email notification it will be said “otherwise the group will be deleted on …”, but once you start joggling with dates – this will not be true probably.
tbp
tbp
tbp
Nobody likes garbage, including Microsoft 365 administrators. If any user can create a team or yammer community – they create, but then they leave company and we are getting more and more abandoned groups, teams and SharePoint sites. So we need a way to clean up environment. There is a Microsoft 365 groups expiration policy that can help remove unused groups from the system, but since all Teams and Yammer sites are group-based – it also helps SharePoint admins make things cleaner. In a nutshell what this policy does is it sends notifications to group owners so a group owner can renew the group, otherwise the group will expire and be deleted.
The policy lives under Azure Portal, Azure Active Directory, Groups, Expiration:
Microsoft 365 groups expiration policy can be configured by Groups Admin or Global Admin (tenant admin) only. Microsoft 365 Teams or SharePoint admin cannot configure it. Microsoft says that User administrator can do it – so I need to verify it.
Here is the policy config screen:
Microsoft documented it well in the “Microsoft 365 group expiration policy“, but I completed some tests in my lab environment and here is what I found and what is not covered by Microsoft. Let me share it with Questions and Answers format:
Q: How long it takes for policy to start generating notification emails after activation?
A: Immediately, i.e. minutes, maybe up to one hour (in case there groups that are subject for the policy).
Q: Can I customize email that is send to group owners?
A: No, there is no such option at the moment.
Q: What is the email address notifications come from?
A: It’s “msgroupsteam@microsoft.com” with the display name “Microsoft Groups Team”
Q: What does a notification email look like?
A: Please find some examples below, in the end of this article.
Q: Are there other ways to get notifications? Teams?
A: I have not seen any official Microsoft’s documentation on this, but yes – notifications are coming via Teams too: “TeamName is expiring soon. Renew now”:
though it is not clear what exactly should used do to renew the group, as after clicking on that alert a regular teams settings page is opened:
and I got just a few notification in teams, though e-mails notifications I got many.
Q: What happens when a user clicks “Renew group” button in the email notification?
A: User will be sent to a Microsoft’s page and the following “Do you want to renew the group?” window will be shown:
On Yes, it says”<groupName> was successfully renewed. You can close this window now”:
And the group expiration date will be set up as current date.
On “No” it says “Group was not renewed. You can close this window now.”:
And an expiration day will not be changed. No more notifications will be generated. The group will be active until expiration date. Then the group will be deleted.
Q: What if two owners choose opposite?
A: The last action will take effect.
Q: what if one user choose “delete group” but the other one later decided “Renew group”?
A: The one who click “Renew group” will see “<Group Name> successfully renewed. Because the group was deleted, it might take up to 24 hours to be fully restored. You can close this window now.”
Q: What if the group does not have owners?
A: If the group is orphan (ownerless), the expiration emails will go to the email specified in policy configuration. Usually it is a distribution list with admins or other responsible team.
Q: What if the group does have a non-mail-enabled owner?
A: I have tested 2 types of entities with no email:
– just a contact in Outlook
– user with no Exchange license assigned
Results are: Outlook contact cannot be added to team, so there should be no contacts as teams/groups owners; a user with no Exchange licens can be added to team/group and Microsoft does not consider this group ownerless, so notification should be sent to group owners, but since there is no email associated to a group owner – e-mail are not sent, so we are having an issue here.
Q: What if I deactivate the policy – will email notifications sent earlier still be actionable?
In other words, would users still be able to renew the group clicking on the “Renew group” button?
A: Yes. Actually “Renew group” button is just a link to the Url:https://account.activedirectory.windowsazure.com/Group/RenewGroup?tenantId=<tenantId>&id=<groupId>
where a group owner can renew group.
Q: If one of the owners renewed the group – what will happen with notifications sent to other owner? What if other owner click “Renew group” or “delete group”?
A: Notifications sent will stay. Since buttons in the email are just links (not actionable buttons) – user will be redirected to a web-page where he/she will be able to renew or delete the group.
Q: As per MS: “Groups that are actively in use are renewed automatically around 35 days before the group expires. In this case, the owner does not get any renewal notifications. Any of the following actions will automatically renew a group…<list of actions>”. So, what exactly does “Groups that are actively in use” mean?
A: This is not disclosed by Microsoft. They only say “Azure Active Directory (Azure AD), part of Microsoft Entra, uses intelligence to automatically renew groups based on whether they have been in recent use. This renewal decision is based on user activity in groups across Microsoft 365 services like Outlook, SharePoint, Teams, Yammer, and others.” Btw, <list of actions> includes almost all user actions – so basically any action – even just visit site/team is considered as activity.
Q: Can I track the policy in action via audit log?
A: There is no “activity type” for this policy’s specific actions… You also cannot specify user “msgroupsteam@microsoft.com” to get all activities. So no tracks on the policy “before action” – i.e. at the detection and e-mailing stage.
If a user clicks “renew” button or “delete group” link – this should be logged as this user action with Category “GroupManagement” and activity: “Update group” and “RenewedDateTime” as property modified.
If it happens that the group is deleted by policy – this should be logged under policy’s account – see below.
Automatically renewed group appears as audit log event with
– Workload: AzureActiveDirectory
– RecordType: 8 “AzureActiveDirectory”
– Activity: “Update group”
– Properties modified would be “RenewedDateTime”
Automatically deleted group appears as audit log event with
– Workload: AzureActiveDirectory
– RecordType: 8 “AzureActiveDirectory”
– Activity: “Delete group.”
Microsoft groups lifetime policy operates on behalf of Actor (first-party Microsoft service principal):
more on first-party Microsoft service principals
Q: After the group is deleted, who can restore it?
A: MS says: “A deleted Microsoft 365 group can be restored within 30 days by a group owner or by an Azure AD administrator”.
In fact, SharePoint admin (and maybe some other roles like Teams admin or Exchange admin) can restore group. SharePoint admin can restore site from recycle bin – and the group will be restored as well.
Q: My org is using retention policies. Will the lifecycle policy delete site if it contradicts with retention policy?
A: Lifecycle policy respects retention policy, so if the site should not be deleted according to retention policy or legal hold – the site will not be deleted (TBC – need to be validated).
Q: What if a user forward this e-mail notification to other user? Can this other user renew or delete the group?
A: When a user receive a notification email forwarded, and he/she click “Renew group” button – his/her experience will be the same if he/she is also a group owner. If a user is not a group owner – he/she will get “You don’t have permission to renew this group because you’re not an owner. To renew , contact a group owner. You can close this window now.”:
Note: if a user with active groups administration permissions receives email and try to renew or delete the group – he/she will also be able to do that.
Q: Can user get information on groups he/her owns, groups expiration data? Can user renew the group before the policy trigger email notification?
A: yes, all that can be done from the page: https://myaccount.microsoft.com/groups/groups-i-own
Q: What if I activate m365 groups lifecycle policy for the selected groups only?
Any insight on policy behavior?
A: The policy will work as usual, but for the selected groups only. Separate from the policy – under “my groups” users will be able to see “Expiration date” and “Renew” option for groups in policy’s scope only:
Let say we have a large Microsoft 365 environment with many inactive groups, some of them are inactive for a long time – e.g. 1 or 2 years. We want to implement groups expiration policy, but we want to understand better the policy behavior.
Microsoft says: “The expiration period begins when the group is created, or on the date it was last renewed” and “When you change the expiration policy, the service recalculates the expiration date for each group. It always starts counting from the date when the group was created, and then applies the new expiration policy.”
So in case we implement the policy first time, we know that Renewal Date for all groups is just a Group Creation Date.
Q: What will happen if I activate the policy – will the policy start generating emails immediately for all groups?
A: Yes. Once activated – policy starts detecting expired groups and sending notifications to groups owners. So if you have 3k expired groups with 6k owners in it – expect policy will generate 6k e-mail notifications.
Q: Which groups the policy will be triggered against? All or Inactive only?
A: As per Microsoft, if at around 35 days before expiration it will be determined that group is actually active, the policy can renew the group automatically.
But definition of this activity is not disclosed and might be not the same as group activity status 90 days based on MS Graph data you can see at CA.
(I got notifications for groups that were not active recently but with Active status).
Q: In the case above – what would be the deadline? When the policy will delete the group?
A: If the group expiration period is passed, but the policy was just activated – it does not delete the group immediately. Policy allows ~30-35 days for owners to renew the group.
E.g. My test policy was activated May 3 and I got message for old group immediately, but it said that the group will be deleted on June 7.
Q: What if there are more than 10K emails – will it trigger Exchange throttling?
A: Most likely emails not sent will be sent next day.
Q: Can I specify a distribution list in the policy as an “Email contact for groups with no owners”?
A: Yes
Q: Can I specify an external e-mail address as an “Email contact for groups with no owners”?
A: TBC
Q: Can admin ask user to renew or delete the group by some other custom solution (skipping the policy)?
A: yes. Actually, “Renew group” button is just a link to the following Url:https://account.activedirectory.windowsazure.com/Group/RenewGroup?tenantId=<tenantId>&id=<groupId>
where <tenantId> is tenant id and <groupId> is group Id. So basically anyone
Let me explain the policy behavior in m365 group object model terms.
There is a group property “RenewedDateTime”. When group is created – this property is set up to group created date/time (same as group CreatedDateTime property value).
For the notification purposes the policy calculates “Expected Expiration DateTime” as RenewedDateTime plus “Group LifeTime” (number of days specified in policy, e.g. 180). First notification is triggered about 30 days before “Expected Expiration DateTime”, so the policy simply selects groups with RenewedDateTime property value less then current DateTime minus “Group LifeTime days” minus 30 days and sends notification starting from oldest group:
RenewedDateTime < Today - GroupLifeTime -30
When owner confirms group is still needed – RenewedDateTime is setup to current DateTime.
Q: When a user chose to “Renew group” – will it impact group activity?
A: No. If a user did not visit group – but just clicked “Renew group” – it will not trigger group last activity date. E.g. inactive group will still be inactive.
Q: Is there an API to configure Microsoft 365 groups expiration policy programmatically?
A: Yes, in MS Graph API it is called Group Lifecycle Policy: groupLifecyclePolicy.
Q: Can I programmatically renew the group (all groups) as an admin?
A: Yes, consider using Microsoft Graph API or PowerShell 7 with PnP.PowerShell module.
PnP Doc says Reset-PnPMicrosoft365GroupExpiration command “Renews the Microsoft 365 Group by extending its expiration with the number of days defined in the group expiration policy set on the Azure Active Directory” – but that does not seem accurate. This command sets up “RenewedDateTime” group property to the current datetime, not related to current policy settings (the policy might even not have been activated).
Microsoft Graph API entry point: “POST /groups/{id}/renew“
Group.ReadWrite.All permissions required.
Q: Is it possible to setup “RenewedDateTime” property to another date/time of my choice (not the current date)?
A: Apparently that is not possible. I could not find a way so far… It says Property 'renewedDateTime' is read-only and cannot be set.
Q: What permissions are required to renew the group with Reset-PnPMicrosoft365GroupExpiration?
A: Group.ReadWrite.All – delegated or application
Q: What exactly is behind the automatic groups renewal?
A: Actually, the is a separate process in parallel with groups expiration policy – and this process starts monitoring groups activity ~35 days before expiration and once activity is detected – the process resets group RenewedDateTime property. And the moment this date is reset – the group is excluded from policy.
Q: If I activate the policy not for all but for a selected groups only, will I still be able to renew other groups programmatically?
A: Yes, as an admin – you can resets group RenewedDateTime property programmatically all alone. It does not matter – whether this policy is activated or not.
Notification e-mail that comes to group owners “as is” – web outlook view:
Notification e-mail that comes to group owners when content is unblocked (web outlook):
Notification e-mail that comes to group owners when pictures are loaded (desktop Outlook):
Notification e-mail that comes to group owners some key areas:
And I’d add that e-mail says how many members in this group (number of members, not including owners… i.e. if you are the only owner – it’ll be zero members).
Correction: “Renew group” is not an actionable button – it is just a html button with a link.
Screenshot of the notification that comes to email specified in policy for the groups that does not have owners:
Renew group button is visible if the expiration policy is activated:
When the not renewed group reaches expiration date – the policy deletes the group and group owners get an e-mail notification like this:
Email subject would be “Attention: <group name> was deleted. Restore it by Thursday, August 10, 2023” and in the body “
<group name> expired on Monday, July 10, 2023. It was deleted, along with all associated communications, files, calendar events, and tasks. You have 30 days from the expiration date to restore Test Priv team – ownerless groups policy and its content. You received this email because you’re an owner of the group”.
Owner can restore group within 30 days by simply clicking “Restore group” button. Then owner would be redirected to the “https://myaccount.microsoft.com/groups/action?groupId=<groupId>&action=Restore” and get a message “The group was successfully restored. It might take up to 24 hours before you can access all associated content. You can close this window now.”
Microsoft recently implemented “Adaptive” retention policies. At step 2 of “Create retention policy” you’ll be asked “Choose the type of retention policy to create”: “A policy can be adaptive or static. Advantage of an adaptive policy will automatically update where it’s applied based on attributes or properties you’ll define. A static policy is applied to content in a fixed set of locations and must be manually updated if those locations change.”
And if you selected “Adaptive” – on the next step you will need to provide the adaptive scope (so at this moment you should already have created your adaptive scopes):
So, let us create your adaptive scopes.
What type of scope do you want to create? SharePoint sites…
And then you’ll have nothing more then set of conditions:
where you can use objects: “Site Url”, “Site Name” and “Refinable String 0″..”Refinable String 99”. Conditions would be “is equal to”, “is not equal to”, “starts with” and “not starts with”. Or you can select “Advanced query builder” and enter KQL query.
Microsoft recently implemented “Adaptive Scopes” for retention policies”. Before that we had to use “static” scopes only, i.e. we could apply the policy to all sites or to specific selected sites we had to choose manually. With adaptive scopes we can use rules like “This adaptive scope must include all sites with Site Url starts with A or Site name starts with A” and so on. And then we’d apply the retention policy to all the sites in this adaptive scope. This is nice, but actually site Url and site name does not have much to do with sites categorization for the retention policies. How can we implement sites classification to apply different policies to different sites categories? Luckily, when you configure adaptive scopes, you can use Refinable Strings, and refinable strings is something you can configure to have values from custom site properties. So finally we can assign specific value to custom site property and the site would fall under this or that retention policy based on the value we dynamically assigned to the site.
Note: you can also use site properties like date site created or site last modified date in advanced query builder under adaptive scopes – please check “Microsoft 365 Retention Policies SharePoint Adaptive Scopes Advanced Query“.
The steps are:
Detailed steps:
Create an indexed site property or “Adaptive Scope Property” with some values. Ensure you property name (key) is unique, e.g.
| Property | Value |
|---|---|
| SiteRetentionCategory | Y10 |
You can use PowerShell (with PnP.PowerShell module) commands:
Set-PnPAdaptiveScopeProperty or
Set-PnPPropertyBagValue -Indexed:$true. Examples:
Set-PnPAdaptiveScopeProperty -Key "SiteRetentionProperty" -Value "Y10"Wait until search crawler picked up you site property. Now you have a crawled property.
As you know, Refinable Strings are just pre-created by Microsoft refinable managed properties. So you can select one that is not used(*) and map it to crawled property.
You can assign alias so you could easily identify what is the RefinableString55 about (but aliases do not work in advanced query).
select one that is not used
select one that is not used is an important, bacause if you select refinable string that is already taken at the some site level – there is a conflict. So before configuring pre-created refinable properties at tenant level – I’d recommend to get report on managed properties taken at sites levels. It would be good idea if you arrange with sites owners on properties ranges (e.g. from 00 to 99 – reserved for tenant use, from 100 to 199 – available at sites level search customizations). And/or you can – after getting report on managed properties taken at sites levels – reserve all unused managed properties by assigning aliases e.g. “this-property-55-is-reserved-by-admin-for-tenant-level-config”.
site custom script
If site custom scripts are enabled (DenyAddAndCustomizePages = false), then site collection admin can change site properties. So if you do not want the property being altered at site level – ensure that noscript site property is enabled (DenyAddAndCustomizePages equals true)
If site custom scripts are disabled (DenyAddAndCustomizePages = true), then an admin must enable them before using “Set-PnPPropertyBagValue” cmdlet (then disable again).
“Set-PnPAdaptiveScopeProperty” cmdlet handles this automatically.
As I am a SharePoint person, and retention policies and labels are not a SharePoint engineer responsibility, I do not go to the m365 Compliance Center frequently. Below are My notes for myself on key moments – how to create and configure Office 365 retention labels and Policies at Compliance Center and use labels in SharePoint Online (SPO).
In SPO at each site collection level you can still work with retention policies the old way – create policies under Site Collection Settings – Content Type Policy – and apply policies at library level under Library Settings/Information Management Policy Settings. There is also Site Retention Policy.
But Microsoft is making efforts to centralize and unify such things – so you can specify retention policies in one place and apply them across all Office 365 content (not only SharePoint). That place was called Office 365 Security and Compliance Center (SCC). Later Microsoft separated Security Center and Compliance Center. So currently Retention Policies are under “Microsoft Purview” (former Microsoft Compliance Center) -> Solutions -> “Data lifecycle management”:
To get access to “Data lifecycle management” solution – you need to have a “” or “” roles. SharePoint or Teams administrator cannot access Purview. Even having “Global reader” or “Security reader” an admin will not be able to see “Data lifecycle management” blade. Here is how Microsoft Purview looks like for a Global reader:
Although SharePoint admins usually do not have access to SCC and do not go to Site content, we still need to know how it all works. And labels are recommended way to specify retention in SharePoint, so here we are.
Labels are applied to documents, documents are kept in libraries, and at each library you can “Apply a label to items in this library”.
Labels are created in SCC under Classification. The main part looks familiar to SharePoint people:
You can
after it was created/modified/labelled
Now you need to publish created labels – and that is how you create a policy. I.e. policies are where you specify which labels to which content (Exchange, OneDrive, SharePoint, Office 365 groups)
You can also auto-apply labels based on conditions, like
but as per Microsoft, “It will take up to 7 days to automatically apply the label to all items that match your conditions.”
Note: “trainable classifier” means an AI ML will be used, and as per Microsoft “Creating machine learning rules requires an Office 365 E5 subscription for your organization”
You can do nothing with labels at SharePoint admin center. Labels are created, published and auto-applied at SCC. At each site collection levels site administrators can apply labels.
At site collection settings you can still see “Content Type Policy Templates” and “Site Policy”, but that is not the case. Labels are applied at library level under Library Settings/Apply label to items in this list or library.
where you can select a label to apply for all new items in the library. With
You can also apply the label to items that already exist in the library.
You can also apply (change) label for each single item or multiple selected items under Details pop-up page:
or from under Contect Menu/More/Compliance details:
Microsoft recently implemented “Adaptive” retention policies. At step 2 of “Create retention policy” you’ll be asked “Choose the type of retention policy to create”: “A policy can be adaptive or static. Advantage of an adaptive policy will automatically update where it’s applied based on attributes or properties you’ll define. A static policy is applied to content in a fixed set of locations and must be manually updated if those locations change.”
And if you selected “Adaptive” – on the next step you will need to provide the adaptive scope (so at this moment you should already have created your adaptive scopes):
So, let us create your adaptive scopes.
What type of scope do you want to create? SharePoint sites…
And then you’ll have nothing more then set of conditions:
where you can use objects: “Site Url”, “Site Name” and “Refinable String 0″..”Refinable String 99”. Conditions would be “is equal to”, “is not equal to”, “starts with” and “not starts with”. Or you can select “Advanced query builder” and enter LQL query.
What is the takeaway from this for SharePoint administrators? We would be asked to configure SharePoint the way compliance/retention people can use Refinable Strings.
It would be a good idea to let users know, that their files will be deleted, but the next question would be “can I get a list of files that are scheduled to deletion”?
Surely it is possible for admins to go through site content and find files that were modified last time earlier than a specific date, but there is another method – you can recommend your users to search through their site using
See details in “How to figure out – which files are expiring due to age and going to be deleted as result of retention policy.”