Microsoft 365

This video looks at the functionality in an EDRMS and how that functionality compares with SharePoint.
 

This video explores the key ways in which you can access SharePoint.

This video talks through best practices to facilitate the management and eventual disposal of records in SharePoint.

This video looks at ways to manage emails, chats and posts.

This video looks at metadata management, including moving metadata with records.

This video looks in-depth at content types and how they connect with metadata.

This video explores how search connects with metadata in SharePoint and utilising advanced searching options.

This video looks at options for long-term agency retention of records and metadata created or captured in Microsoft 365.

This video gives a brief introduction to key recordkeeping functionality in Purview.

This video looks at disposal options available in Microsoft 365.

This video looks at options and issues with managing inactive mailboxes and OneDrives of departed users.

This video speaks to best practice permission management in SharePoint.

This video looks at who has access to what, including oversharing, especially given generative AI capabilities.

The table below provides examples of recordkeeping information relevant for some common Microsoft 365 software services. Note that this is not a complete list, and that information on services listed may not be current as services are updated/upgraded regularly.

Effective records management aims to ensure that:

• Full, reliable and accurate records are created, captured and managed
• The integrity of records and associated metadata is maintained
• People are able to find what they are looking for when they need it
• Records are secure from unauthorised access and destruction
• Accessible records are exported along with their contextual metadata from the system when required
• Records remain accessible for as long as they are needed and then lawfully disposed of.

This can be achieved through a range of different means, including:

• Working across and within Microsoft 365 services to build records management functionality and associated processes in compliance with PROV standards.
• Integration with an Enterprise Content Management System, or Electronic Document and Record Management System (or another similar solution) in compliance with PROV standards.

PROV recommends using the M365 Guide to plan and undertake the following actions:

1. Determine the kind of licence held (e.g., E3, E5) and whether your public office is part of a multi-tenant agreement or standalone (this information will determine what is possible within M365 for your organisation).
2. Obtain knowledge of the administrative applications and tools used to manage records in Microsoft 365. Please note that there are multiple administrative centres across Microsoft 365. There are also various configuration settings in these centres that can be applied for appropriate records management.
3. Conduct a gap analysis to determine whether these controls are sufficient to manage records within the agency or whether additional controls, configuration, or integration is needed.
4. Assess the culture of the agency to determine the probability and impact of users not complying with records management controls within the Microsoft 365 environment.
5. Set controls for records that consider the user experience and minimise risk of non-compliance (Purview Compliance Manager includes pre-built assessments for common regional and industry standards and regulations, it is recommended to use them in conjunction with the relevant PROV Standard to minimise gaps as there are often spaces in the M365 assessments that require manual entry.
6. Where AI or machine learning tools are used ensure that a program of regular monitoring and auditing of the process by a human being is in place and that risks are identified and mitigated appropriately.
7. Where third party plug-ins are to be used, develop, and maintain an integration management plan that specifies how the impact of Microsoft 365 updates and upgrades will be monitored and risk to records minimised.
8. Determine where and how automation can be best applied to minimise risk to records and improve effective control of records (Power Automate can be used in conjunction with retention labels to automate retention and disposal).
9. Be aware of Microsoft 365 Purview records management and data lifecycle management functionality, how they can be used to manage disposal of public records, and where other mechanisms or processes are needed. Purview Records Management includes retention labels, policies, and file plans for retention and disposal, while Purview Data Lifecycle Management covers retention for workloads and manages messages (Teams and Viva Engage) and email (inactive and archive mailboxes).
10. Conduct a gap assessment and management plan against disposal requirements to determine and minimise risk to records.
11. Consider and seek to minimise risk to records when determining whether to migrate records from a decommissioned system (including systems that manage email) into Microsoft 365.

Ideally, records management controls should be included during the planning and configuration stage. The ability to adjust configuration settings may be limited post implementation, but some controls may still be applied. For example:

• Microsoft have a validation method that should be used when migrating records into SharePoint or OneDrive as metadata is automatically updated when uploading files.
• To manage public records in M365, both data management and record management functionality are required (both are in Microsoft Purview) and will need to work together to ensure controls (including retention and disposal) are lawfully applied.
• Setting permissions for records manager functionality occurs across multiple portals (including M365 Defender and Purview Portal; see the M365 Guide for details) and permissions are based on the role-based access control (RBAC) permissions model. Permissions can only be managed by someone with the correct admin role status (role management).
• Logging can be automated to ensure that accountability or integrity questions can be effectively addressed depending on the license held.
• Labels and labelling policies are applied in different ways and can be used to manage retention of records and security regimes, including sensitivity classifications. Automated labelling can be applied depending on the license held.
• Retention labels can be used to mark items as a record or a regulatory record, both of which have additional controls that can be applied. Records have more flexibility regarding actions that can be applied compared with regulatory records. Please note that regulatory records cannot be edited or deleted. Once the label of regulatory record is applied to an item, it cannot be removed by anyone. Regulatory records cannot have their retention period shortened. If an item is checked out in SharePoint, it cannot be made a regulatory record. Regulatory record declaration functionality must be enabled using PowerShell.
• Retention labels can be used as classification labels if the retention action is set to review later.
• Usage rights are applied through sensitivity labels, policy, or role-based permission levels, and can be configured to automatically apply to the label or template selected. Be aware of whether usage rights will be applied to the single instance only or across a broader group as different methods of application cover different situations.
• Unique IDs for documents can be set up within SharePoint Online using the automatic SharePoint Document ID functionality, but this is not the default, and the functionality must be activated by a site collection administrator. Please note that the unique document ID will only travel with the document if the location it has moved to also has unique ID functionality. Otherwise, it will be removed from the document.
• Alerts can be set up or customised to advise of unauthorised deletions, changes, and amendments and should be appropriate for regulatory, legislative, and business reporting (including reporting of risk to records). Alerts require auditing to be enabled and searchable and can be set up through Purview. Functionality is dependent on the license held. Please note that audit logs are only retained for 90 days with the standard Audit package but are retained for one year with a premium audit package and can be expanded to 10-year retention if an additional license is purchased.
• Reporting tools can be used to identify user behaviours that place records at risk so that appropriate governance structures can be put in place (note that functionality will depend on the license held).
• E-Discovery tools that search all content, including email, can be set up through Purview (note that functionality will depend on the license held).

If the Microsoft 365 service is integrated with an EDRMS or ECM system, then disposal controls can continue to be applied in that system through traditional methods (such as assigning retention periods through the business classification scheme and folder structure).

In M365, retention and disposal are controlled within Purview. To ensure that disposal covers all areas of M365, including email and chat, both data management and records management functionality are required (see the table, below). Some features require full E5 license or equivalent, while others only need E3 or equivalent – see M365 https://learn.microsoft.com/en-us/microsoft-365/compliance/manage-data-governance for details.

Be aware that:

• There are multiple repositories where records may be saved across the different apps and sites that make up M365.
• Different software or services across M365 may have different retention settings or limitations. Ensure that you know how retention works for the specific area of M365 you are working within and use the right retention tool for the right situation.
• Records with a retention policy applied that are edited or deleted will have a copy saved to a set location that may be different to its original location. If you don’t have the right permissions, you will not see the folders that content is saved within.
• As a copy of anything with a retention setting is saved to a default folder anytime someone edits or deletes it, ensure that storage capacity is sufficient to hold your records.
• If the retention setting is to travel with the content, regardless of where it is, assign retention using retention labels; retention settings applied by policy only apply to the current location of the content, and will no longer be applied if the content is moved.
• For retention labels to be automated, there needs to be a common element they can be applied to. For example, type of information, keyword, or pattern matches. Content search can be used to locate items with the same retention label.
• Retention policies can be applied to specific users, multiple locations, or specific locations.
• Proof of disposition is supplied when using retention labels under certain circumstances (such as declaring content to be a record) but only for up to seven years.
• If you are in a tenancy, then some settings are applied across the whole tenancy. See https://learn.microsoft.com/en-us/microsoft-365/enterprise/subscriptions-licenses-accounts-and-tenants-for-microsoft-cloud-offerings for details on the difference between licenses, tenants and so on.
• For details see: https://learn.microsoft.com/en-us/microsoft-365/compliance/retention

There are a lot of resources available on the web that address disposal in some way that may be of value, such as the following:

• Records and Information Management Practitioner’s Association (RIMPA Global) hold regular sessions on M365 (see their website for details: https://www.rimpa.com.au/)
• Joanne Klein (e.g. https://joannecklein.com/2023/03/15/a-records-managers-guide-to-auto-applying-retention-labels-using-sharepoint-ia/)
• Andrew Warland (e.g. Records about the world – My blog about managing records and information especially in Microsoft 365)

Below is a table of possible risk to records that may be encountered when implementing Microsoft 365 and some suggested mitigation strategies.

Apps and other products in or aligned with M365 are often retired and replaced with a new product that does something similar. Often migration of any documents created using the previous version will need to be migrated into something else as once the app or product is retired, the functionality will no longer work, and content will be lost. Generally, there will be:

• An announcement with information about what (if anything) will be replacing the retired app/product, timeframes, and key milestones.
• Time to identify what needs to be migrated, plan for the migration, and capture any other documentation of relevance.
• A cut-off point where the app or product will no longer function.

Microsoft 365 is a cloud service that utilises web-based applications (including forms of social media). As such, records management advice for cloud computing, electronic approvals, management of websites, social media, migration, enterprise mobility and decommissioning systems also apply. 

Microsoft 365 should be implemented in line with PROV recordkeeping standards and policies.