Leadership through Data were recently at the ARA conference in Chester, UK. Our trainer, Sara Fennah gave a session on Microsoft 365 records management and both Sara and Jacqueline Stockwell, CEO took part in a panel session on Microsoft 365 with Jaki also leading a communications themed workshop entitled Why Aren’t They Listening to Me?
First some Pictures from Jaki’s session.
This rest of this blog accompanies Sara’s session on Records Management in Microsoft 365, focusing on changes in the post COVID era.
Yes, we can debate if we are ‘post’ COVID, but we are going to focus on what has changed due to COVID, as well as giving you a background on what features are available in Microsoft 365.
We all know about world events since 2020 and that we are living in a world significant change. Change is not new! There is a reason so many quotes about change exist. And whilst regulations and best practice around archiving, information governance and records management have not changed because of COVID, the way we work has.
Hybrid work is the current buzz word. What it actually means is that people are accessing, creating and using information from multiple locations, devices and services. This flexibility in working methods probably means we need us to consider changes to how we configure Microsoft 365 to manage that information. Or, maybe it is push you need to adopt Microsoft 365 for records management. And you may be the lucky person in the room whose environment is still perfect ;-)
It’s also an opportunity to review our working practices, communicate with our colleagues and take advantage of change to adapt and improve.
From the conference keynote entitled The Opportunity of Change, Jack Kirby from the Science Museum Group shared many gems with us. I noted 4 phrases which tie in nicely with the topic of this session, as you’ll see as we continue:
- Stable Technology
- Digital First
- Improving Discovery
- Opportunity of Data
What are the challenges your organisation faces post COVID that they did not have pre-COVID with regard to Records Management? I strongly believe a lot of these challenges can be eased, from a technology standpoint with automation! Especially given the ever increasing volume of information we create and manage.
Given users are working from multiple devices some of which do not have the tools available to assign retention, defaulting with rules based on the content, template or location will help to ensure content is preserved.
Features such as disposition reviews and the ability to assign a different label at the end of the retention period automatically can really help with keeping control even when things are automated.
It will come as no surprise to members of the ARA, that the aims of retentions and records management in Microsoft 365 are:
- To keep what needs keeping
- To remove what doesn’t need keeping
- To preserve content as is
The key point in the post-covid era, with hybrid work being so all consuming is that these features need to work regardless of device, location or app.
Microsoft 365 Records Management includes features to:
- Enforce Retention and/or Deletion
- Declare content as a record without relocating it (keeping it in the same place)
- Facilitate review of deletion and keep records for reporting on deletion and provide proof of deletion
- Provide flexibility to what can be changed on content whilst it is regarded as a record – locked = no changes, unlocked= permit changes. Allows for versions of documents to be records, yet keep only one file (use SharePoint version history to see the versions which are records) Can be switch On/Of in Record Management Settings
- Regulatory Records feature to provide totally immutable records during retention period with no overrides for regulatory compliance
- Items can be manually declared as records using retention labels. Labels can be applied by a user manually or automatically based on the content of the item (sensitive information/keywords) or a defined document type (known as a content type).
- Retention or deletion can be triggered based on events (like an employee leaving, end of a FY) or document creation/update or label application
- You can also set a default for the location either using a policy or by applying a label to the container
For the official details see https://docs.microsoft.com/en-us/microsoft-365/compliance/records-management?view=o365-worldwide&WT.mc_id=M365-MVP-5004583for more information
Labels can be manually assigned from Outlook (e- mail) or SharePoint for files (Note this covers files in Teams as well)
The first image on the slide shows assigning a retention policy to mail in Outlook desktop app, the second assigning a label to a file in SharePoint and finally using an Asset ID to link a record to event triggered retention, in this case the end of a financial year.
The Outlook desktop client will now also prevent deletion of email which is a record AND you can access that document information pane even if you are working on files in Teams.
Automatic labelling uses three Microsoft 365 features to assign labels:
- Sensitive Information Types (built in are things like passport numbers, credit card numbers. Custom – employee ID numbers, customer numbers, etc – things which are unique to your organisation)
- Trainable Classifiers (document identification, such as contract, agreements. You can create and train custom classifiers for organisation specific documents too)
- Content Types (templates) – note with a little bit of effort we can make these templates available in most place people create new documents from, which enables us to link retention/record settings to the templated documents.
New content types and sensitive information types incl Full Names and Physical addresses have been released in the last year, however automatic labelling does require an E5 license.
We manage retention by creating a retention policy or a retention/record label. Retention policies allow you to set the default for a location and are also used to govern retention for Teams. Retention (or Records) labels are applied to files or folders, either manually or using rules.
Retention and Records Management features allow you to:
- Retain then automatically delete content
- Retain for minimum period then allow manual deletion
- Retain then review for disposal, thus obtaining a record of deletion (requiresE5 license)
- Lock the file to prevent changes. This is referred to as a Record or a Regulatory Record and requires E5 license.
- Retain forever, block deletion
- Delete at certain age, but allow manual deletion in the meantime
- Just tag, no retention, locking or auto deletion
4 Steps to create a retention or record label
Step 1 – After setting a name choose the main aim
Step 2 – After choosing the aim you can set the period
Step 3 – choose what happens during the retention period (only when creating a label from Records Management)
Step 4 – choose what happens at the end of the retention period.
Retention can be driven from the date content was created, last modified or from an event date.
Event driven retention, allows us to set trigger dates for retention periods which then linked to a type of event, for example the end of a financial year, and the specific event would be a specific financial year, which is identified by a tag for documents or by keywords in e-mail
Event driven retention requires E5 licensing.
A multistage approval for the disposition of the document can be applied with up to 5 stages With each stage only requiring one person to approve.
At review the item can be deleted, relabelled or the retention period extended, all with the ability to view the content. There are lots of options around permissions to control access here to the content under review, incl ability to add reviewers during the disposition approval process.
Disposition reviews provide proof of disposal but does require E5 licences.
Scope refers to the locations the retention settings are available from/applied to. So as I set up the rules I can specify where the labels are available or where the settings from a policy are assigned by default. For example we may wish to keep all content in the OneDrive of our finance teams for 10 years and HR for 20 years. The way we can do that is manually assign a retention policy to each user depending on their department OR build an ‘adaptive’ scope that looks at the department in their user profile.
Adaptive scopes are designed for larger dynamic organisations and as such required E5 licenses.
With retention and records settings being applied in a number of different ways (with a manually assigned label, or an automatically assigned label, or by a default label for the location or a policy set on the location) each piece of content can be covered by more than one ‘rule’. Therefore this policy lookup feature is very helpful. You can check a user or location and see which rules can be applied. This makes tracking down what is in place & troubleshooting much easier.
In tenants with E5 licences admins can also ensure all protected data is not deleted, thus bypassing the normal retention process
When it comes to retention and when there is overlap it is important to remember the general principle of retention, which the policy lookup features does help with.
See also https://docs.microsoft.com/en-us/microsoft-365/compliance/retention?view=o365-worldwide#the-principles-of-retention-or-what-takes-precedence
Looking back at those key phrases from the keynote, let’s review what Microsoft 365 offers us.
- Stable Technology in terms of ongoing access to the content is an assurance Microsoft have given, despite the rapid pace of change in the products. But it can only give access to content which has been retained.
- Digital First. There is no doubt digital data is exploding with cloud computing. These features enable us to also protect that information in its digital format.
- Improving Discovery. I haven’t touched on discovery features, but if you retain it, we can find it, from Office 365, from search engine integration for your users and for the apps they work in.
- Opportunity of Data. Data is valuable, but we need to be able to find it and look after it in order to profit from it.
And if this short taster is not enough information for you, we at LTD offer many courses and webinars, both virtual and in person cover soft skills as well as Microsoft 365.
