In May 2021, Microsoft announced the release of multi-stage disposition reviews.  This announcement was not limited to just the disposition review enhancements but other new features as well.  Included with the May release were other custom disposition configurations such as record manager enhancements (think disposition administrators) and disposition message customization.  The Microsoft announcement did just that, announced them.  In this post, I’ll show you what they are and how they work.

Disclaimer: Microsoft is making changes all the time to the Microsoft 365 interface.  Any screenshots displayed in this post are current at the last edit of the post.

Enhancements for Record Managers

I honestly think one of the best enhancements is the creation of what I am calling a disposition administrator. Previously, even if record managers weren’t the users to review content disposition, they needed to be part of the label’s disposition reviewers.  Without being granted this access, record managers will not even see which retention labels have dispositions waiting. Even global admins won’t be able to see this information.  In the following screenshot, I am logged in as a global administrator.  Observe that I do not have any view into retention disposition:

Information and Records Management in M365 - Custom Disposition Configurations - Disposition Review No Access

However, in this instance, I am logged in as one of the disposition reviewers:

Information and Records Management in M365 - Custom Disposition Configurations - Disposition Review With Access

The problem this posed is that often, all disposition reviewers were added to a single security group.  This group was then used within all of the labels requiring a disposition review.  This meant content owners could see content to which they were not supposed to be privy.  With this latest enhancement, a disposition reviewer no longer requires elevated access within the Compliance Console; they can be limited to only the disposition reviews they need to be.  Now, this hasn’t really changed from before, but what has changed is granting a mail-enabled security group a global view of all disposition reviews occurring for all retention labels within the organization.  No longer do you have to ensure the organization record manager is part of every different disposition review configuration within each label.  They need to be added to the “Security group for record manager”.  My own terminology is “Disposition Administrators”.  Let’s try to make that take off.

To add a security group as the global record manager, complete the following steps:

  1. Login to the Microsoft 365 Compliance Admin Console
  2. Click on Records Management
  3. Click on Disposition
  4. Click on Records management settings

Information and Records Management in M365 - Custom Disposition Configurations - Record Management Settings

  1. Click on “Select a mail-enabled security group.”

Information and Records Management in M365 - Custom Disposition Configurations - Select Mail-Enabled Group for Record Management

  1. Select the group containing the disposition administrators (users who should have access to all disposition reviews).

Information and Records Management in M365 - Custom Disposition Configurations - Add Global Disposition Administrator Group

  1. Click Add
  2. Click Save.

One important note.  This is a one-time setting (from the user interface).  If the group needs to be modified or added to PowerShell will be required.  To add additional groups as disposition administrators utilize the following M365 Security and Compliance commandlet:

Enable-ComplianceTagStorage -RecordsManagementSecurityGroupEmail "Mail-Enabled Group"

After adding the group to the tenant, my own account (which is part of the security group) can now see all items up for disposition:

Information and Records Management in M365 - Custom Disposition Configurations - Disposition List after Disposition Administrator Update

 

Customization of the Disposition Review Emails

Another important update is the ability to customize the emails disposition reviewers can receive as part of the disposition process.  One thing I want to make clear is you cannot customize the entire message. Instead, Microsoft is simply allowing you to customize text after a certain location within the email.  By default, a disposition message looks like this:

You’re getting this mail to let you know that items with a retention label applied have reached the end of their retention period and are ready for your disposition review.

Label applied: <Label Name>

Next steps
Review the items on the Dispositions page of the Microsoft 365 compliance center.

Thanks,
The Microsoft 365 compliance team

The first two lines of the message cannot be modified.  Any custom text will be added after “Label applied:….”.  It will appear before “Next steps”  A couple of important items to note:

  • Only text is supported (no images)
  • URLs and email addresses may show up as links if the email client supports them, but no guarantee is given.
  • The email does not currently support macro or short-code lines (e.g. [TODAY] to enter the current date)

To customize the message utilizing the following steps:

  1. Login to the Microsoft 365 Compliance Admin Console
  2. Click on Records Management
  3. Click on Disposition
  4. Click on Records management settings
  5. Select the option “Add content to the default message.”
  6. Add the text required for the custom notification
  7. Repeat for reminder emails if required

Information and Records Management in M365 - Custom Disposition Configurations - Customize Disposition Email Notification Messages

The result will appear similar to the following:

Information and Records Management in M365 - Custom Disposition Configurations - Custom Email Notification

The next post will be the final in this series, where I cover the multi-stage disposition review.

Thanks for reading!