The two systems
MRM (Messaging Records Management): retention TAGS (default, folder-level DPT, personal) bundled into a retention POLICY assigned per mailbox; the Managed Folder Assistant processes mailboxes on its own cadence, moving/deleting per tag. This is the machine behind the RetentionPolicyTag objects our scan holds (13 in a typical tenant) and the '30 day delete' tag on Deleted Items your users half-remember. Mailbox-scoped, user-visible tags, archive-move actions.
Purview retention (the modern layer): org-wide or scoped policies (adaptive or static) spanning Exchange AND everything else, retain/delete with the multi-day pipeline (the Teams retention concept's mechanics), holds trumping all.
How they coexist (the precedence you must know)
Both can act on the same item. The resolution: retention wins over deletion, longest retention wins, explicit wins over implicit, holds beat everything — Purview's principles, which MRM delete-tags are evaluated within. The practical failures:
| Symptom | Cause |
|---|---|
| "Mail deleted after 2 years, no policy I set" | An inherited MRM default-delete tag from the 2016 build, still processing |
| Purview 'retain 7yr' + MRM 'delete 1yr' → item survives | Retention wins — working as designed, surprising everyone |
| Archive fills unexpectedly | MRM move-to-archive DPT nobody remembers, auto-expanding archive concept next door |
| "Nothing deletes despite my Purview policy" | A hold (or longer retention) trumping — check the mailbox's holds |
The migration reality
New estates should live in Purview; brownfield estates carry MRM sediment. The move: INVENTORY the MRM tags/policies actually assigned (our scan is the inventory), decide keep-vs-Purview per behaviour, and retire MRM delete-tags DELIBERATELY (removing a tag doesn't un-delete, but stops future surprise deletions) — a project, because 'just turn off MRM' orphans folder-level behaviours users depend on.
What to watch (proofs)
- The MRM inventory: Get-RetentionPolicy / Get-RetentionPolicyTag (scanned — 13 tags means 13 behaviours to account for); assigned vs orphaned.
- What acted on an item: the mailbox's retention/hold state (Get-Mailbox | fl Retention, Hold) + Purview policy lookup — the two-system walk per 'why did this vanish' ticket.
- MFA processing evidence: items moving/deleting on the assistant's cadence — the 'it deleted days later' lag explained.
- Coexistence audits: mailboxes under BOTH systems (most of them) — the precedence-surprise candidates, worth a documented expected-outcome per sensitive population.