People-First Purview (Technical): Records Management

The strategy post made the case that records management fails as a communication problem before it fails as a configuration problem. Disposition review queues go untouched not because reviewers are negligent, but because nobody told them what they were deciding or why it mattered.

This post assumes you've had that conversation. Now we configure.

The walkthrough covers three things in order: retention label configuration for records, disposition review workflow design, and adaptive scopes. Each one has a decision point where organizations get into trouble. We'll call those out as they come.

Retention Labels: Records vs. Regulatory Records

The first decision when configuring a retention label as a record is which kind.

Purview gives you two options. A standard record restricts editing and deletion while the retention period is active, but an administrator can still unlock it if needed. A regulatory record locks the content immediately and cannot be unlocked by anyone once applied.

Regulatory records cannot be removed, modified, or unlocked after they are applied. Not by an admin. Not by Microsoft support.

Most organizations do not need regulatory records. They are designed for content subject to specific regulatory frameworks (SEC Rule 17a-4, FINRA, certain healthcare mandates) where immutability is a legal requirement. If your legal team has not specifically asked for records with no administrative override, standard records are almost certainly the right choice.

Regulatory records also cannot be applied via auto-labeling policies. They must be applied manually through a published retention label policy. The operational overhead is higher, and there is no path back once the label is on the content.

The failure mode I see consistently: organizations select regulatory records because it sounds more compliant. More permanent and more compliant are different things.

Confusing them creates a content management problem that cannot be fixed after the fact.

Naming Labels for the People Who Use Them

One configuration detail worth getting right before moving to disposition review: the label name.

Retention labels are visible to end users in some configurations and always visible to disposition reviewers. A label called RL-LEGAL-007 tells a reviewer nothing. A label called Legal - Contracts - 7yr - Record tells them the content category, the retention period, and that a disposition decision is required.

The naming convention that works in practice: [Business function] -- [Content type] -- [Retention period] -- [Record type]. Not every label needs all four components, but reviewers need at minimum the business function and retention period in the label name itself.

The reviewer who can't place a label will either approve everything reflexively or close the queue. The label name is cheap to fix. The downstream behavior is not.

Disposition Review: Designing for the Reviewer

Disposition review is triggered when a retention label's period expires and the label is configured to require review before disposal. The content lands in a queue in the Purview compliance portal and someone has to make a decision.

Purview does not set a default deadline for how long reviewers have to act. Without configuration, items sit in the queue indefinitely. Auto-approval is available as an optional setting where you specify a window between 7 and 365 days, and if no reviewer acts within that period, the item automatically moves to the next stage or is disposed at the final stage. The default if you enable it is 14 days, which is not enough time for most review processes. Set it deliberately, or leave it off and accept that your queue depends entirely on reviewers actually opening it.

Reviewer assignment is the second place things break. Purview allows you to assign reviewers at the label level. The people you assign need permission to access the disposition review interface, enough familiarity with the content category to recognize what they're looking at, and a clear understanding of what approving disposition means.

One permissions detail that consistently surprises people: global administrators do not have the Disposition Management role by default. Reviewers need that role explicitly assigned, and so does any admin who needs visibility across all disposition queues. Plan for this before the first review cycle, not during it.

Approving disposition at the final stage marks the item eligible for permanent deletion, which Purview then carries out within 15 days. It is not immediate. Reviewers who understand this distinction are better positioned to hold a review if something comes up before that window closes.

Multi-stage review is available if a single reviewer is not sufficient for your governance model. Legal review followed by records manager sign-off, for example. Configure stages to match your actual escalation path. A three-stage review process where two stages go to the same person is friction without function.

Proof of disposition is generated automatically when deletion is approved. It is a permanent, tamper-evident record that the content existed, who reviewed it, and when deletion was authorized. For regulated industries, this is the audit artifact that demonstrates the program is functioning as designed.

Adaptive Scopes: What They Require

Adaptive scopes let you define the population a retention policy applies to dynamically, based on attributes like department, location, or sensitivity label rather than a static list of sites or mailboxes.

The benefit is real. When someone joins Legal, their mailbox automatically falls under the Legal retention policy. When a SharePoint site gets labeled as containing financial records, it automatically picks up the appropriate retention policy. You stop managing lists and start managing rules.

Adaptive scopes evaluate continuously. Scope membership can change after a policy is applied, and that change is immediate.

Queries run daily against Entra attributes. If an attribute driving scope membership changes (a user's department is updated in Entra, a site's label gets modified) that user or site may move in or out of scope of an active retention policy without any explicit action. Content that was previously governed may no longer be.

This is not a reason to avoid adaptive scopes. It is a reason to understand your data before you implement them. Organizations that deploy adaptive scopes before their attribute data is clean and their label taxonomy is stable will create policy gaps they won't notice until something is missing.

The practical question to answer first: are the attributes driving scope membership consistently maintained? If the answer involves any version of "mostly" or "it depends," static scopes are the more defensible starting point.

Before You Apply a Single Label

The configuration decisions in this post only work if the program behind them is sound. Regulatory vs. standard is a legal question. Reviewer assignment is an accountability question. Adaptive scope readiness is a data quality question.

The right order is still decisions first, portal second.

If the strategy post raised questions your organization hasn't answered yet, those answers come before this walkthrough does. The mechanics are straightforward once the program is designed. Configuring without that foundation just means the problems show up later and are harder to trace back to where they started.