Exchange Online Retention Policy Not Applying: A Read-First Purview vs MRM, Distribution, and Scope Triage

Helpdesk: "Compliance turned on a Delete after 3 years retention policy for all mailboxes in Purview last week. Mail from 2019 is still sitting in people's Inboxes, and Outlook still shows the old Default 2 year move to archive tag. Can you delete the policy and recreate it, and run the Managed Folder Assistant on everyone?" An hour later a second ticket: the shared Accounts Payable mailbox was added to a different retention policy last month, and nothing about it looks any different.

Don't delete and recreate anything yet. "Exchange Online retention policy" means two different systems in the same portal, and most "not applying" tickets are really a mix-up between them or a policy that hasn't finished arriving. A Purview retention policy only does what you expect when the whole chain holds: you're looking at the right system (Microsoft 365 retention vs Exchange MRM) → the policy has rules and is enabled in Enforce mode → distribution finished without errors → the mailbox is actually in scope (static includes, adaptive query, location type, license) → the mailbox has at least 10 MB and is being processed → no other retention, label, or hold changes the outcome (principles of retention) → you waited long enough for the timer job. Microsoft says to allow up to seven days for retention settings to apply, and its own fix list for stuck policies starts with distribution status, not recreation.

If the real complaint is "the mailbox is full and nothing moves to the archive," that's MRM Move to Archive and the Managed Folder Assistant. It's covered in Exchange Online mailbox full but the online archive isn't helping. This post covers retain and delete settings that look like they "aren't applying": a Purview policy that doesn't delete, doesn't keep, doesn't show, or doesn't reach one mailbox, and how it interacts with MRM tags, retention labels, and holds.

TL;DR

• Two systems, one portal. Microsoft 365 (Purview) retention policies live under Data Lifecycle Management > Microsoft 365 > Retention policies and use Security & Compliance PowerShell (Get-RetentionCompliancePolicy). Exchange MRM policies and tags live under Data lifecycle management > Exchange (legacy) and use Exchange Online PowerShell (Get-RetentionPolicy, Get-RetentionPolicyTag). They work side by side. Read the one the ticket is actually about.
• Distribution first. Read the policy with -DistributionDetail. Microsoft says without that switch, DistributionStatus and the location values are inaccurate. Pending is normal for a while. Error has a documented fix list.
• Scope is the usual culprit. Static policies expand groups when you configure them and don't follow later membership changes. Adaptive scopes run once a day and can take up to five days to populate. Microsoft 365 group mailboxes aren't covered by the Exchange mailboxes location at all.
• Retention wins over deletion. A delete policy that "isn't deleting" is often losing, correctly, to a longer retain policy, a retention label, Litigation Hold, an eDiscovery hold, or a 30-day delay hold.
• Seven days and 10 MB. Mailboxes need at least 10 MB of data before retention settings apply, and the processing job can take up to seven days. Expired items are permanently deleted within 14 days after the retention period ends by default.
• Don't recreate the policy first. A rebuild restarts distribution and the seven-day clock. Microsoft does lock some settings at creation (the name, adaptive vs static, and retention settings other than the period), so a new policy is sometimes the right answer, but only after the other layers check out, and built alongside the old one.

---

Where in the chain did it break?

Step	What should be true	Typical symptom when it breaks
1. Right system	You know whether the ticket is about a Purview policy, an MRM policy/tag, or a retention label	"The retention policy" with nobody sure which one
2. Policy health	Policy has rules, is enabled, Mode = Enforce	"Settings not found"; policy listed but does nothing anywhere
3. Distribution	DistributionStatus = Success, no DistributionResults errors	Enabled (Pending) for days, or (Error) in the portal
4. Scope	The mailbox is included (static or adaptive) and is a supported type	Works for most users, not for the new hire, the shared mailbox, or the group
5. Mailbox side	Hold GUID present on the mailbox or org; mailbox ≥ 10 MB and processed	InPlaceHolds doesn't show the policy; ELC last success is old
6. Precedence	No other retention, label, or hold produces a different outcome	Delete policy doesn't delete; retain policy "lost" items to an MRM tag
7. Waited	Up to 7 days to apply, plus up to 14 days after expiry for permanent deletion	"Still not working" two days after the change

Write down the policy name, the mailbox's primary SMTP address, the mailbox type (user, shared, resource, group, inactive), what the user expected (keep, delete, or move), and what they actually see, ideally a screenshot of the message header in Outlook.

Step 1: Which system is in play? (read-only)

Clue in the ticket	System	Where to read it
"Move to archive after 2 years," archive mailbox, Outlook Archive Policy	Exchange MRM (Move to Archive tag)	Exchange (legacy) > MRM Retention policies / tags; see the 5gpo post
Tag on a specific Outlook folder (Deleted Items, Junk), personal tags users pick	Exchange MRM (RPT / personal tag)	Get-RetentionPolicy, Get-RetentionPolicyTag
Policy created by compliance/legal for "all mailboxes," retain X years	Purview retention policy	Data Lifecycle Management > Microsoft 365 > Retention policies
User picks a label from Assign policy in Outlook, or auto-apply by keyword	Purview retention label	Retention labels + Label policies
"We can't delete anything" or mail "won't go away"	Any hold: Purview policy, label, Litigation Hold, eDiscovery, delay hold	Get-Mailbox hold properties (Step 5)

Microsoft now recommends Purview retention policies and labels for retaining and deleting mail, and says to keep using MRM to move messages to archive mailboxes. Purview policies apply to the whole mailbox. They can't target one folder the way an MRM retention policy tag can. If someone expects "delete only Junk after 30 days" from a Purview policy, that expectation is the bug.

Two more MRM facts that explain a lot of tickets:

• A mailbox can have only one MRM retention policy (the RetentionPolicy property). New Exchange Online mailboxes get the Default MRM Policy automatically.
• MRM tags and Purview retention policies don't replace each other. An MRM tag keeps moving or deleting items on its schedule even after a Purview policy is added. What changes is whether "deleted" items are then kept in Recoverable Items (Step 6).

# Read-only. Exchange Online PowerShell (Connect-ExchangeOnline).
$mbx = '[e-mail]'
Get-Mailbox -Identity $mbx | Select-Object DisplayName, RecipientTypeDetails, RetentionPolicy,
  RetentionHoldEnabled, ElcProcessingDisabled, LitigationHoldEnabled
# RetentionPolicy here is the MRM policy only. Purview policies don't appear in this field.
(Get-RetentionPolicy -Identity (Get-Mailbox $mbx).RetentionPolicy).RetentionPolicyTagLinks
Get-RetentionPolicyTag | Select-Object Name, Type, RetentionAction, AgeLimitForRetention, RetentionEnabled

Step 2: Is the Purview policy healthy? (read-only)

In Microsoft Purview portal > Solutions > Data Lifecycle Management > Policies > Retention policies, select the policy name (not the checkbox) to open the details pane. Then confirm the same thing in PowerShell:

# Read-only. Security & Compliance PowerShell (Connect-IPPSSession).
$p = 'Mail - Delete after 3 years'
Get-RetentionCompliancePolicy -Identity $p -DistributionDetail |
  Format-List Name, Enabled, Mode, DistributionStatus, ExchangeLocation, ExchangeLocationException
Get-RetentionCompliancePolicy -Identity $p -DistributionDetail |
  Select-Object -ExpandProperty DistributionResults
Get-RetentionComplianceRule -Policy $p |
  Select-Object Name, RetentionDuration, RetentionComplianceAction, ExpirationDateOption
# RetentionComplianceAction: Keep | Delete | KeepAndDelete
# ExpirationDateOption: CreationAgeInDays | ModificationAgeInDays

What to look for:

• No rule. The portal error Settings not found means the policy has no retention rules. It exists and does nothing.
• Mode. Microsoft lists Test, AuditAndNotify, and Enforce. Only Enforce enforces.
• Action vs expectation. A Keep rule never deletes. A Delete rule doesn't retain anything. Microsoft also notes that users don't see the retention banner in Outlook for retain-only policies, so "users can't see our policy" can be correct behavior.
• Start of the period. For email, the retention period runs from when the item was created (received or sent). "Last modified" is a files option. Do the date math on the oldest item, not the policy creation date.

Step 3: Read distribution status (read-only)

Microsoft says it can take up to seven days for a retention policy to be distributed to the locations you picked and then applied to content. Pending for a day isn't an incident. Pending for a week, or any (Error), is.

Errors Microsoft documents in DistributionResults, and what they mean:

Portal message	DistributionResults value	Meaning
Something went wrong	PolicyNotifyError	Error in the notification pipeline of policy sync
The location is ambiguous	MultipleInactiveRecipientsError	A location matched more than one recipient
We're still processing your policy	PolicySyncTimeout	Sync didn't finish in the expected time
We can't process your policy	ActiveDirectorySyncError	Policy didn't sync with Microsoft Entra ID
We couldn't find this location	FailedToOpenContainer	Location no longer exists; you must remove it on the next edit
We ran into a problem	InternalError	Unspecified error in sync and distribution
You can't apply a hold here (when adding)	RecipientTypeNotAllowed	That mailbox type isn't supported by this policy

For most of these, Microsoft's documented fix is Retry in the details pane or Set-RetentionCompliancePolicy -Identity <policy> -RetryDistribution, after removing duplicate or missing locations where the error calls for it. That's a change, but a small one. It's not a delete-and-recreate. Get-RetentionCompliancePolicy -ErrorPolicyOnly lists every policy that currently has distribution errors, which is a fast tenant-wide check.

Step 4: Is this mailbox actually in scope? (read-only)

Static scope (the default): All mailboxes, or specific includes, or specific excludes.

• Groups are expanded once. If you picked a distribution group or mail-enabled security group as an include, Microsoft says membership is expanded at the time of configuration. People added to the group later aren't added to the policy. That explains "it works for everyone except the new hires."
• Limits. Static include/exclude lists are capped at 1,000 mailboxes per policy. All mailboxes has no limit and new mailboxes inherit it automatically.
• Removing the last include flips the policy to All. Microsoft warns that if you remove the last included mailbox, the location reverts to All. On a delete policy, that's the expensive mistake. Turn the location off instead if that's the intent.
• Wrong location type. The Exchange mailboxes location covers user, shared, and resource mailboxes, but not Microsoft 365 group mailboxes. Those need the Microsoft 365 Group mailboxes & sites location. (Trying to add one to the Exchange location ends in a RemoteGroupMailbox error on save.)
• Inactive mailboxes. Static All mailboxes includes inactive mailboxes. Specific includes and excludes don't support picking inactive mailboxes, though a mailbox that was included while active stays included after it goes inactive.

Adaptive scope:

• The query runs once a day, and Microsoft says it can take up to five days for a new or changed query to fully populate. The simple query builder doesn't validate values, so a typo in a department name just returns nobody.
• Adaptive scopes include inactive mailboxes by default unless the query adds (IsInactiveMailbox -eq "False").
• Microsoft notes that users without a valid license for adaptive scopes don't get the policy applied. Adaptive policy scopes need E5-level licensing (Microsoft 365/Office 365 E5/A5/G5 or the E5 Information Protection and Governance add-on). Static policies are covered by E3-level and Business Premium licensing. Confirm against the current service description.

# Read-only. Security & Compliance PowerShell: what adaptive scopes exist?
Get-AdaptiveScope | Format-Table Name, LocationType -AutoSize
# Read-only. Exchange Online PowerShell: does your scope query return the mailbox you expect?
# Paste the scope's OPATH query between the braces.
Get-Recipient -RecipientTypeDetails UserMailbox,SharedMailbox -ResultSize Unlimited `
  -Filter {Department -eq "Accounts Payable"} | Select-Object Name, PrimarySmtpAddress, RecipientTypeDetails

The scope's details page in Purview shows members with a State of Added or Removed. Microsoft says that list can also take up to five days to update. For a single mailbox, Policy lookup in Data Lifecycle Management lists every retention policy assigned to an exact email address. It doesn't accept wildcards or partial matches.

Step 5: Read the mailbox side (read-only)

Purview retention policies show up on the mailbox as hold GUIDs, not as the RetentionPolicy field.

# Read-only. Exchange Online PowerShell.
$mbx = '[e-mail]'
Get-Mailbox -Identity $mbx | Select-Object -ExpandProperty InPlaceHolds
#   mbx<guid>:1  delete (or publishes labels)   mbx<guid>:2  retain only   mbx<guid>:3  retain then delete
#   -mbx<guid>   this mailbox is EXCLUDED from that org-wide policy
#   UniH<guid>   eDiscovery hold        cld<guid> or no prefix   legacy In-Place Hold
Get-OrganizationConfig | Select-Object -ExpandProperty InPlaceHolds   # org-wide (All mailboxes) policies live here
Get-Mailbox -Identity $mbx | Format-List LitigationHoldEnabled, *HoldApplied*   # ComplianceTagHoldApplied, DelayHoldApplied, DelayReleaseHoldApplied

Then map a GUID back to a name in Security & Compliance PowerShell: Get-RetentionCompliancePolicy <guid without prefix or suffix> -DistributionDetail | Format-List Name, *Location.

How to read it:

• Mailbox InPlaceHolds is empty. That doesn't mean "no policy." Org-wide policies are listed under Get-OrganizationConfig, not on each mailbox.
• A -mbx entry. Someone excluded this mailbox from an org-wide policy. That's a policy decision to find, not a bug.
• ComplianceTagHoldApplied = True. A user applied a retain label to a folder or item, so the mailbox is treated much like it's on hold.
• DelayHoldApplied / DelayReleaseHoldApplied = True. A hold was removed recently. Microsoft keeps a 30-day delay hold so nothing is purged immediately. Removing it early is a Legal Hold role decision, not a helpdesk fix.

Is the mailbox even being processed? Microsoft's labels article shows how to read the last processing time:

# Read-only. Exchange Online PowerShell.
$logProps = Export-MailboxDiagnosticLogs -Identity $mbx -ExtendedProperties
$xmlprops = [xml]($logProps.MailboxLog)
$xmlprops.Properties.MailboxTable.Property | Where-Object { $_.Name -like 'ELC*' }
# ELCLastSuccessTimeStamp (UTC): when the mailbox was last processed.
Get-MailboxStatistics -Identity $mbx | Select-Object TotalItemSize, ItemCount
Get-MailboxFolderStatistics -Identity $mbx -IncludeOldestAndNewestItems |
  Select-Object FolderPath, ItemsInFolder, FolderSize, OldestItemReceivedDate
Get-MailboxFolderStatistics -Identity $mbx -FolderScope RecoverableItems |
  Select-Object FolderPath, ItemsInFolder, FolderSize

• Under 10 MB. Microsoft says mailboxes need at least 10 MB of data before retention settings apply. A brand-new shared mailbox can sit below that.
• ElcProcessingDisabled = True. The Managed Folder Assistant won't process the mailbox at all. RetentionHoldEnabled = True pauses MRM processing only (often set for leave and never reverted).
• Recoverable Items full. If Recoverable Items hits its quota, Microsoft says the Managed Folder Assistant can't delete items based on retention tags. The defaults are 20 GB warning / 30 GB limit, raised to 90 / 100 GB when the mailbox is on hold or has a Purview retention policy.
• DiscoveryHolds growing under Recoverable Items is a sign a Purview retention policy is actively keeping hard-deleted items. That's the policy working.

Step 6: Which setting wins? (read-only)

More than one retention policy can apply to the same item, plus one retention label, plus holds. Microsoft's principles of retention settle the outcome, top to bottom:

Order	Principle	What it means for the ticket
1	Retention wins over deletion	A delete policy won't permanently delete an item another policy, label, or hold must keep. The item may leave the user's view, but permanent deletion is suspended
2	Longest retention period wins	3-year retain + 7-year retain = 7 years
3	Explicit wins over implicit for deletions	A retention label's delete action beats any policy's delete action. Among policies, a scoped policy (adaptive or specific includes) beats an org-wide one
4	Shortest deletion period wins	Only if the earlier levels didn't decide it

eDiscovery holds also fall under principle 1. Priority cleanup policies are the documented exception that can override holds. Ask whether one exists before you assume the principles apply cleanly.

Common translations:

• "Our delete policy isn't deleting." Look for a retain policy, a retain label (ComplianceTagHoldApplied), Litigation Hold, an eDiscovery hold (UniH), or a delay hold. Any one of them correctly wins.
• "Our retain policy isn't working, an MRM tag deleted the mail." The MRM tag still moved the item out of the folder. With a Purview retain policy on the mailbox, it should be retained in Recoverable Items until the retention period ends, which is where eDiscovery searches find it. Check Recoverable Items before you call it data loss.
• "Outlook shows the wrong policy." Microsoft says Outlook shows the retention policy with the shortest expiry date for that item, and a retention label's name always replaces the policy name. Nothing appears for retain-only policies.

MRM-only precedence is simpler: a tag explicitly on an item beats its folder's tag, which beats the default policy tag (DPT). Items moved into a folder inherit that folder's tag.

Step 7: Retention labels vs MRM tags in Outlook

Users see Assign policy in Outlook with Purview retention labels listed alongside any legacy MRM personal tags. That's by design, and it's where "the retention tag isn't applying" tickets come from.

• Labels take time. Microsoft says labels published to Exchange can take up to seven days to appear, because the process that makes them available runs every seven days. The mailbox must have at least 10 MB. Compare ELCLastSuccessTimeStamp (Step 5) with when the label policy was published.
• Label policy distribution uses the same status and errors as Step 3.
• What labels cover. Labels apply to mail, notes, and tasks with an end date. Calendar items with an end date are supported for retention policies but not labels. Contacts aren't supported by either.
• Auto-apply by sensitive information type labels mail sent and received, not mail already stored in the mailbox (simulation runs against stored mail, which confuses people).

Step 8: Timing and expiry: what "applied" actually looks like

Event	What to expect
Purview retention policy created or edited	Up to 7 days to distribute and apply (often faster)
Adaptive scope created or query changed	Up to 5 days to fully populate; wait before adding a new scope to a policy
Retention label published to Exchange	Up to 7 days to appear in Outlook
Retain-and-delete period ends, item untouched	Item is permanently deleted within 14 days by default (configurable up to 30)
Delete-only period ends	Item moves to Recoverable Items, then is permanently deleted after 14 days
Hold or policy removed from a mailbox	30-day delay hold before purging resumes
User account deleted, mailbox under a retain policy	Mailbox becomes inactive and stays subject to the policy. A delete-only policy doesn't make it inactive

Two inactive-mailbox traps, both from Microsoft's inactive mailbox guidance:

• Confirm the hold before deleting the user. If the policy hadn't reached the mailbox yet (Steps 3–5), the mailbox won't become inactive, and after 30 days the data is gone.
• Explicit vs implicit. If an explicitly scoped policy is released from an inactive mailbox, the mailbox becomes eligible for automatic deletion. Under an org-wide All mailboxes retain policy it never becomes eligible for automatic deletion; once the retention period has expired, an Exchange admin can delete it manually. See the offboarding checklist for the disable-vs-delete order.

---

When a change is justified

Finding	Prefer	Avoid
Ticket is really MRM Move to Archive	Work the MRM tag/archive chain	Creating a Purview policy to "move mail" (it can't)
Policy has no rule	Add the rule (Microsoft's documented fix for Settings not found)	Deleting and recreating the policy
Wrong action or wrong scope type	Compliance decides; build the corrected policy alongside the old one and validate it (these settings are fixed at creation)	Deleting the old policy before the new one is confirmed on real mailboxes
Distribution Error	Remove duplicate/missing locations if called for, then Retry	Toggling the policy off and on repeatedly
Pending under 7 days	Wait and re-read with -DistributionDetail	Bulk Start-ManagedFolderAssistant on every mailbox
Static group include missed new members	Add the missing mailboxes to the includes, or move to an adaptive scope	Removing the last include (reverts to All)
Group mailbox not covered	Add it under Microsoft 365 Group mailboxes & sites	Forcing it into the Exchange location
Delete policy losing to a hold	Confirm the hold's owner and purpose	Removing Litigation Hold, eDiscovery holds, or delay holds to "make it work"
RetentionHoldEnabled left on	Turn it off for that mailbox after confirming the reason	Setting ElcProcessingDisabled
Need a policy no one can weaken	Plan Preservation Lock deliberately (it can't be undone; adaptive scopes don't support it)	Locking a policy you haven't validated

---

FAQ

Why is my Exchange Online retention policy not applying?
Usually one of: it's the other system (MRM vs Purview), the Purview policy has no rule or isn't in Enforce mode, distribution is still pending or in error, the mailbox isn't in scope (static group expanded at creation, adaptive query still populating, group mailbox in the wrong location, missing license), the mailbox is under 10 MB or not being processed, or another retention setting or hold wins. Read Get-RetentionCompliancePolicy -DistributionDetail first, then the mailbox's InPlaceHolds.

What's the difference between a Purview retention policy and an Exchange retention policy?
A Purview (Microsoft 365) retention policy can retain, delete, or both, applies to the whole mailbox, and appears on mailboxes as hold GUIDs. An Exchange MRM retention policy is a bundle of retention tags (default, folder, and personal) assigned one per mailbox through RetentionPolicy, and Microsoft still recommends it for moving mail to the archive. They run side by side.

How long does a retention policy take to apply in Exchange Online?
Microsoft says to allow up to seven days for a retention policy to distribute and apply, and up to seven days for published retention labels to appear in Outlook. Adaptive scopes can take up to five days to populate. Once an item's retention period ends, permanent deletion happens within 14 days by default.

Why does my retention policy show Enabled (Pending)?
Distribution to the selected locations hasn't finished. Re-read it with Get-RetentionCompliancePolicy -Identity <name> -DistributionDetail, because without that switch the status isn't accurate. If it moves to an error, or stays pending well past seven days, use the documented Retry (Set-RetentionCompliancePolicy -RetryDistribution) after fixing any location the error names.

Why isn't the retention policy deleting old emails?
Retention wins over deletion. Another retain policy, a retention label, Litigation Hold, an eDiscovery hold, or a 30-day delay hold keeps the item. Also check that the rule's action is Delete or KeepAndDelete, that you did the date math from when the mail was received, that the 14-day permanent-deletion window has passed, and that Recoverable Items isn't full.

---

Related posts

• Exchange Online "Mailbox Full" but the Online Archive Isn't Helping (MRM Move to Archive and the Managed Folder Assistant)
• Retention Is Not Backup (what retention can and can't restore)
• Does a Shared Mailbox Need a License? (holds, InPlaceHolds, and shared mailbox limits)
• An Offboarding Checklist for M365 and Intune Admins (confirm the hold before you delete the user)
• A Monthly Exchange Online Hygiene Check (forwarding and permissions review with read-only Get cmdlets)

Free checklist

Retention reviews tend to land in the same change window as other tenant-wide policy work, like requiring MFA for every mailbox user or blocking legacy sign-ins, and that's where a rushed Conditional Access change locks people out of the mail you just set out to protect. Before you enforce, the free Conditional Access pre-enforcement checklist keeps break-glass accounts, pilot groups, and report-only review on one page:

👉 https://cashflow4375.gumroad.com/l/ujkqxb?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=exchange-online-retention-policy-not-applying

If you want the rest of the M365 admin runway written down for the team (break/fix cards, offboarding and mailbox decisions, and read-only PowerShell snapshots), the Intune & M365 Admin Starter Pack pairs with this triage: https://cashflow4375.gumroad.com/l/joonf?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=exchange-online-retention-policy-not-applying

---

Admin Pack Studio; not affiliated with Microsoft. Steps 1–8 only read: portal pages, Get-RetentionCompliancePolicy, Get-RetentionComplianceRule, Get-AdaptiveScope, Get-Mailbox, Get-OrganizationConfig, Get-Recipient, Get-MailboxStatistics, Get-MailboxFolderStatistics, and Export-MailboxDiagnosticLogs. Retrying distribution, editing rules or scopes, changing MRM policies or tags, running the Managed Folder Assistant, and removing any hold (Litigation, eDiscovery, delay, or retention hold) are deliberate changes. Retention and hold decisions belong to whoever owns compliance and legal holds. Make changes on one mailbox or one policy first, and check current Microsoft Learn for portal labels, licensing, and timing. Not legal advice.