Microsoft Purview Adaptive Protection: Dynamic Retention Labeling via Data Lifecycle Management

Mo Wasay June 19, 2026 6 min read

REPORT: New Integration – Adaptive Protection Meets Data Lifecycle Management

Microsoft Purview’s Adaptive Protection, already known for dynamically adjusting insider risk policies, is now integrated with Data Lifecycle Management (DLM). This capability, announced for General Availability in August CY2026 (M365 Roadmap 566324), enables automatic application of retention labels to emails and files based on user risk profiles. The feature leverages risk signals from Purview’s insider risk scoring engine to trigger retention policies, ensuring that deleted content is preserved for review or compliance.

Admins can configure this in the Purview admin center (Data Lifecycle Management > Adaptive Protection Integration) and via Microsoft Graph API endpoints for policy automation. The rollout will begin with targeted release tenants in July 2026, reaching worldwide GA by late August.

WHAT’S NEW THIS CYCLE – Feature Details and Technical Path

Feature: Adaptive Protection-based retention label automation
Status: General Availability (GA) August CY2026
Admin Center Path: Microsoft Purview > Data Lifecycle Management > Retention Policies > Adaptive Protection Integration
PowerShell/API: Microsoft Graph endpoint /security/insiderRiskUsers and /compliance/retentionLabels for policy assignment
Preview: Available in select tenants Q2 CY2026, with documentation at docs.microsoft.com

IMPACT: Who Is Affected – Real Tenant Risks

Organizations with regulated workloads, especially those in finance, healthcare, and government, face strict requirements around deleted data. Previously, deleted content by users at elevated risk could evade retention policies unless admins manually updated labels or policies. Now, users flagged as medium/high insider risk will automatically have retention labels applied to email and OneDrive/SharePoint items—even if they are deleted—ensuring regulatory compliance and audit readiness.

Risk: Without this integration, investigations may miss critical evidence due to gaps in retention. For midsize tenants, the risk is compounded by limited staff bandwidth for manual policy updates.

EDUCATE: Underlying Concepts – Adaptive Protection and DLM

Adaptive Protection in Purview uses behavioral analytics (file access, sharing, device activity, etc.) to assign risk levels to users. Data Lifecycle Management governs how long data is retained, deleted, or preserved. The integration means DLM’s retention labels can now be triggered not only by content type/location, but also by real-time risk scoring. Labels such as ‘Preserve for 7 Years – High Risk’ are applied when a user’s risk status crosses thresholds, then removed or downgraded automatically as their risk status changes.

This workflow enables compliance teams to ensure deleted items from risky users are retained for legal discovery, without manual intervention.

DETECT: Audit Your Tenant – Microsoft Graph PowerShell Example

To audit which users have adaptive retention labels applied, use Microsoft Graph PowerShell. The script below enumerates users with active insider risk signals and checks their retention label status. Pagination is handled via -Top and -SkipToken. Error handling ensures failed requests are logged.

# Requires Microsoft.Graph.InsiderRisk and Microsoft.Graph.Compliance modules
Connect-MgGraph -Scopes 'InsiderRisk.Read.All','Compliance.Read.All'

function Get-AdaptiveRetentionStatus {
    [CmdletBinding()]
    param(
        [int]$PageSize = 50
    )
    $skipToken = $null
    $results = @()
    do {
        try {
            $params = @{Top=$PageSize}
            if ($skipToken) { $params.SkipToken = $skipToken }
            $riskUsers = Get-MgSecurityInsiderRiskUser @params
            foreach ($user in $riskUsers.Value) {
                $labels = Get-MgComplianceRetentionLabel -UserId $user.Id
                $results += [PSCustomObject]@{
                    UserPrincipalName = $user.UserPrincipalName
                    RiskLevel = $user.RiskLevel
                    RetentionLabels = ($labels | Select-Object -ExpandProperty DisplayName)
                }
            }
            $skipToken = $riskUsers.OdataNextLink -replace '^.*skiptoken=',''
        } catch {
            Write-Warning "Failed to query user: $_"
        }
    } while ($skipToken)
    return $results
}

$adaptiveRetentionReport = Get-AdaptiveRetentionStatus
$adaptiveRetentionReport | Format-Table

This script only reports status; it does not modify labels. Always review output before making changes.

REMEDIATE SAFELY: Applying Retention Labels – Controlled Action

To remediate, use the following PowerShell snippet to simulate retention label assignment for users at high risk. The script uses -WhatIf to prevent accidental changes. Always supply a reviewed list of user IDs before running any assignment.

# Dry-run: Simulate retention label assignment
param(
    [Parameter(Mandatory=$true)]
    [string[]]$UserIds,
    [Parameter(Mandatory=$true)]
    [string]$RetentionLabel
)
foreach ($userId in $UserIds) {
    Set-MgComplianceRetentionLabel -UserId $userId -LabelName $RetentionLabel -WhatIf
}

Never bulk-modify from a live query. Always use a reviewed input list and test via -WhatIf.

PORTAL EQUIVALENT: Where in Microsoft 365 Admin Center

Purview Admin Center: Data Lifecycle Management > Retention Policies > Adaptive Protection Integration
Insider Risk Management: Policy Configuration > Adaptive Protection
Compliance Center: Data Lifecycle Management > Retention Labels

Portal workflows mirror PowerShell: configure risk thresholds, map retention labels, and review applied policies.

THE UPGRADE: Why This Matters – Productivity, Security, Compliance

Productivity: Admins no longer manually track user risk and adjust retention labels.
Security: High-risk user deletions are preserved for investigation.
Compliance: Automated retention for regulated data reduces risk of non-compliance and costly legal discovery gaps.

Compared to the previous approach—manual policy updates or static retention assignments—this is a leap in automation and risk-based governance.

WHAT’S COMING IN THE NEXT 90 DAYS – Roadmap Items to Prepare For

Purview Audit v2: Expanded API for audit event retention (Q4 CY2026)
SharePoint/OneDrive Data Lifecycle Analytics: Dashboard for tracking risk-based retention (Preview, September CY2026)
Teams Data Retention API: Adaptive retention support for Teams chat and channel messages (Planned, October CY2026)
Insider Risk Policy Templates: New templates to streamline risk-to-retention mapping (Preview, August CY2026)

Admins should review their DLM and Adaptive Protection policy mappings now, prepare for API changes, and ensure staff are trained on new dashboard workflows.

RELATED M365 CHANGES – Broader Workflow Impacts

Purview’s Communication Compliance will soon support risk-based retention triggers for Teams and Yammer.
Intune’s Device Data Retention is being revamped to align with adaptive risk signals, affecting device audit log preservation.
Defender’s Insider Risk Analytics will feed directly into DLM, expanding beyond files to device configuration data.

The integration points between Purview, Intune, and Defender mean admins should revisit cross-product retention policies to ensure risk signals are consistently acted upon.

RECOMMENDATION: Prioritised Takeaway

Assess your current retention label mappings and insider risk policy triggers.
Audit users with elevated risk and verify retention coverage for deleted content.
Prepare for automation: Train admins on both PowerShell (-WhatIf, dry-run) and portal workflows.
Monitor roadmap updates for Teams and SharePoint adaptive retention support.
Document cross-product dependencies—Purview, Intune, Defender—for end-to-end compliance.

Adaptive Protection-driven retention label automation is a game-changer for compliance and security. Plan, audit, and pilot before GA to ensure your data lifecycle safeguards keep pace with dynamic insider risk.