Data Retention Policies in the Age of Copilot

You may not be a records manager, but these policies have a profound impact on eDiscovery.

I’ve mentioned it before, but if you missed it, I’ll be conducting a live demo of Microsoft Loop, discussing what it is, how it works, and why users might already be using it without realizing it. The session is on Thursday afternoon, so if you’re hanging around for the full final day, come say hello!

In the video I shared last week, Tom asked about the retention and preservation of things like Copilot Pages and other Loop objects. We discussed collecting to preserve, but I wanted to provide a deeper look at retention policies in M365 and how SharePoint embedded containers and Copilot are integrated with the Data Lifecycle Management tool in Purview.

Let’s start with the easy one. Copilot interactions.

Recently, Microsoft has created a separate setting to set a retention policy for Copilot. Previously, the option was to put a retention period for Teams Chats and Copilot interactions. I was glad to see them separated. I’m not sure that everyone wants to treat chat and AI interactions the same way. Yes, we can argue that they are both ephemeral communications and don’t need to be stored long-term, but I might disagree that I want them to be the same.

For example, chat may be the most ephemeral form of communication, and I might not want to keep chat messages around more than a few days or weeks. Users may wish to make a slight difference in their approach to Copilot interactions, wanting to revisit previous AI interactions weeks later.

One note: this setting only applies to Copilot and further settings on AI tools. When it comes to retention, these settings only apply to tools within the Microsoft 365 (M365) environment. If you have users of ChatGPT, Claude, or other third-party AI tools, you might want to remind them that those interactions are also subject to discovery.

Loop is going to be a different beast. It’s a document type, so your location(s) will be OneDrive for Business, SharePoint, or SharePoint embedded, depending on how the Loop file was created.

For a typical SharePoint or OneDrive site, the retention is set at the location level. Loop will follow the retention policy set for those locations. Those can vary based on your needs. Some companies have stringent records management requirements, and any retention policy applied to storage locations falls under those; others vary the policies depending on the purpose of the site or the nature of the user who owns the OneDrive.

That’s where the SharePoint containers may create a problem. As I discussed with eDiscovery last week, SharePoint containers aren’t in a location you can point to in Purview.

In essence, I can set a policy that deletes Copilot interactions within 30 days. If you take that response and click the “Edit in Pages” button, it transforms into something entirely different, which falls under the retention policy I have applied to all of SharePoint, assuming I have a single policy applied to all of SharePoint.

Many organizations do not have that policy; thus, Loop files can only be removed by the user.

Others who do have a catch-all policy for SharePoint may not want to apply it to all Loop pages. Users may store notes, AI drafts, task lists, and other content in Loop. Not all of them are the same.

I can understand why legal, records, and compliance professionals aren’t fans of containers.

But that’s not all. Let’s discuss what happens when a user departs.