I won’t pretend I’m not excited – today’s announcement of the new Multi-Staged Disposition capabilities is a huge step forwards for the retention capabilities in Microsoft 365. It will also fundamentally change the way that Retention Labels are architected.
As many of you will know, I’ve been working with the Information & Records Management Society (IRMS) to influence the direction of future records management capabilities in Microsoft 365 through their Customer Advisory Board (CAB). This Board brings national regulatory and archival bodies from around the world into a direct conversation with Microsoft’s Compliance team, in order to help steer the Microsoft 365 roadmap. Today’s announcement has got me especially excited as, Microsoft has announced that they will be improving one of the most significant issues that I have been bringing to their attention for the past year – giving us the ability to delegate disposition reviews.
While the name ‘Multi-Staged’ alludes to one of the new features being introduced by this change, I’m personally not sure that this is the most important aspect of this announcement. Sure, I’ve come across organisations who have wanted to have their records reviewed by more than one team at the end of retention, but this request comes a long way down the list of requested features in Microsoft 365 retention. Instead, the headline news here for me is that hidden within this new functionality is the capability to delegate disposition – something most of the larger organisations I’ve defined retention for have been crying out for.
Until now, when undertaking a Disposition Review in Microsoft 365, all of the records awaiting review were located in a single report. You could nominate reviewers to notify when items classified with specific labels reached the end of retention, but all reviewers granted access to the Disposition section of the Compliance Center were able to see and review records from any part of the tenant. This effectively meant that you either needed to have a single central team reviewing all records, or instead ‘trust’ people from across the organisation to only review their own records (while granting them permission to access and review everyone’s records).
While for smaller organisations this model works fairly well, the larger and more complex the organisation is, the less feasible it is to have a single central area for managing Disposition. This is especially the case in scenarios where multiple organisations share the same tenant. It’s simply infeasible to imagine a complex enterprise-scale organisation trying to either centralise their Disposition Review process, or trust people across the organisation with rights to review each other’s content. This is because:
A central team are typically too distant from the context of the content they are reviewing – it takes too much time to understand the value of the records they are assessing, when they are so far removed from the nature of the content. Typically, practical logistics are also an issue – a central team doesn’t usually have the capacity to adequately review thousands, or even hundreds of thousands of records from across a tenant.
The ‘trust’ approach also isn’t really feasible. Firstly, there are issues with access and privacy – it’s hard to justify allowing people representing specific areas of an organisation (or specific organisations in a pan-organisation tenant) the ability to make decisions over records that could be legally owned by a different entity. Even when trusted to behave correctly, there was no easy way for a given reviewer to identify the records that fell within their jurisdiction. Sure, they could filter by site, but the modern architecture of SharePoint and Teams is such that a typical reviewer might be overseeing records across dozens or even hundreds of separate workspaces.
With neither approach all that feasible, larger organisations have tended to seek to reduce the number of records coming up for review – typically by opting to make more of the Retention Labels resulting in automated deletion. This obviously isn’t ideal, as it risks far more content of value being accidentally deleted at the end of its retention period – resulting in fewer records being retained or transferred to archives. When you think about this in the context of the Public Record, this has meant a significant reduction in the number of digital records being transferred to national archival organisations around the world and potentially a substantial loss of historically significant information.
A new way to delegate disposition
Today’s announcement of multi-staged disposition fundamentally changes the way that Disposition Reviews will be undertaken in Microsoft 365. This change will allow us for the first time to have different teams of reviewers responsible for making disposition decisions for different records; effectively allowing us to delegate the process of undertaking Disposition Reviews.
With this new approach reviewers will only see the records that are currently assigned to them for review. As such, when they are notified, disposition reviews will only see those records that are relevant to them and will not see other records in the tenant.
So how does it work?
I initially assumed that Microsoft would need to introduce some way of marking different Sites, Groups, Teams and Users as belonging to specific parts of the organisation – so that records contained within them would be grouped together for review. However, instead Microsoft has chosen to associate Retention Labels with different groups of reviewers. As such, to take advantage of this new capability, different Retention Labels will need to be created for each different group of disposition reviewers.
This will naturally change the way that organisations design the architecture of the Retention Labels. Rather than having a simple collection of Labels reflecting the functional activity of the organisation, this new model instead requires different labels to be pushed out to different parts of the organisation. At its simplest this will require organisations to create (or duplicate) a separate set of Retention Labels for each group of Disposition Reviewers. For example, if one of your labels is ‘Financial’, this change might well require you to introduce multiple different Financial’ labels, each with different reviewers, and then ensure that the correct version of the ‘Financial’ label is available in each Site, Team and Mailbox. Achieving the latter will likely require changes to your existing process for onboarding staff and also to the way you create new SharePoint sites and Microsoft Teams.
Let’s use the example of a University with separate Departments, each of whom need to review their own records independently. This new change would require:
A group of Disposition Reviewers to be created for each of the University’s Departments. I’d recommend that Mail-Enabled Security Groups are used for this purpose (certainly over and above naming individual reviewers).
Separate Retention Labels would need to be created for each Department. Each of these Retention Labels would need to be associated with the group of Disposition Reviewers.
To allow Retention Labels to be used in Outlook and OneDrive, a process would need to be introduced to ensure that each member of staff receives labels which allow their content to be overseen by the correct group of Disposition Reviewers.
For Teams Channel Messages and SharePoint content (including files stored in Teams) another process would need to be introduced to identify which Retention Labels should be made available in each workspace (and therefore which group will be undertaking Disposition Reviewers for records in this workspace). This will almost certainly need to be introduced as part of a workspace provisioning process.
So why are they called ‘multi-stage’?
While I’m most excited by the ability to delegate disposition reviews, the ‘headline’ feature being introduced by Microsoft with this announcement is the ability to allow up to five successive reviews to be undertaken on each record. In other words, when defining your Retention Labels, you will be able to create up to five separate review steps, with each step having its own group of reviewers.
All of these reviews are conducted as serial stages (so reviews are not undertaken at the same time as parallel activities). With each stage any individual reviewer can make a disposition decision on a given record unilaterally.
Don’t get me wrong, having the ability to have multiple stages in a disposition review process is a great addition to see introduced – but it’s the ability to delegate disposition review that has got me really excited!
Transition to multi-stage
The way that Microsoft has chosen to introduce this concept of multi-staged disposition will be low impact. All of your existing Retention Labels that result in a Disposition Review will already have at least one reviewer assigned to them – these are the people who would currently be notified when the records reach the end of their retention. Once this feature has been rolled out, these reviewers will continue to be notified when records reach the end of their retention period, but they will now only be able to see the records that they are currently assigned to review.
It’s worth pointing out that undertaking a Disposition Review in Microsoft 365 requires a premium licence¹ – as such, it is assumed that the same licences will be required to use multi-staged disposition.
Final thoughts
The introduction of multi-staged disposition reviews will be hugely beneficial for multiple organisations, especially enterprise-sized organisations who are looking to make the most of Microsoft 365’s retention capabilities. Having the ability to delegate disposition review is a game-changer, helping to allow decisions to be made by staff who are familiar with the specific activities and understand the real value and context of the records. I’m certain that many of the organisations I’ve worked with over the past couple of years will be really excited to see this new capability and will be keen to ensure that their Retention Labels and processes are updated to allow them to take advantage of delegated review.
Footnotes
1 – One of the premium licences are required for every user who has the ability to modify any content that will be subject to a Disposition Review in Microsoft 365. These premium licences are currently: “Microsoft 365 E5”, “Microsoft 365 E5 Compliance”, “Microsoft 365 E5 Information Protection & Governance”, “Office 365 E5”, or the legacy “Office 365 Advanced Compliance”.