Information and Records Management in M365 – Multi-Stage Disposition Reviews

Previously I provided an overview of record disposition in Microsoft 365.  Disposition reviews allow an organization to control if the content flagged for permanent deletion should actually be deleted.  The review provides the organization with a method to maintain content due to internal process changes, mislabeling the content, or data that is still active and shouldn’t be removed.  Before May of 2021, Microsoft 365 was only capable of single-stage disposition reviews for retention labels.  However, Microsoft 365 now supports multi-stage disposition revies by allowing up to 5 separate approval stages before the content can be permanently deleted from the environment.  We’ll cover that process in this post.  I would also suggest that you review some of the other enhancements that Microsoft 365 provides by reviewing the custom disposition configurations I also cover.

Disclaimer: Microsoft is making changes all the time to the Microsoft 365 interface.  Any screenshots displayed in this post are current at the last edit of the post.

What are Multi-Stage Disposition Reviews

A multi-stage disposition review is exactly as it sounds.  No longer are record managers limited to single stages with only one group of users (usually themselves) notified of dispositions pending in the system.  Previously, a record manager would be notified of content pending disposition. Then it would take a fair amount of work to contact the subject matter experts (SMEs) to ensure the content was ready for disposition.  The reason for this is that if a SME was granted access to view content for disposition, they could potentially view content that did not belong to them, and they shouldn’t be able to review.  Because of this, administrators would only allow a select few (and often not the data’s SME) to actually control the disposition of content.  I discuss this in more detail in my custom disposition configuration post.

Multi-stage disposition reviews differ from this in that you actually can safely allow specific users who are actually SMEs of the content to review the data automatically.  In fact, all the necessary approvals can be achieved before the record manager even receives a notification the content is ready for disposition.  At that point, the record manager doesn’t need to know if the content is still required or needs to be retained for a longer timeframe due to the business process.  That has been taken care of before the record manager receiving a notification by the SME and perhaps a second level such as a department manager/director.  This means the record manager needs to review the content based on organizational rules and regulatory requirements.  This allows for a significant streamlining of the process. The following diagram illustrates the high-level process.  Note that this may not always be the case while the approval is received within all stages in the diagram.  At any point, the content’s disposition process could be halted by relabeling or extending the retention period at any of the stages).

One thing I want to ensure you are aware of.  If you have retention labels that span multiple locations, the data (at least the file names) will be available to everyone that has access to that particular label as a disposition reviewer.  For example, your organization has a label called ADMIN374 – Meeting Notes.  This is a fairly general and common item in many organizations.  It also likely spans multiple sites.  Because Microsoft attaches the disposition review control to the label and not to the location (or label and location), this poses a problem if there are strict access guidelines within the organization.  If User1 is the ADMIN374 disposition reviewer for SiteA and User2 is the ADMIN374 disposition reviewer for SiteX, they will both get notified for pending dispositions even if the content up for disposition isn’t a part of their site.  While User2 won’t be able to access the actual content of SiteA’s disposition list, User2 will at least be able to see the document’s title up for disposition.  Some organizations would consider this a security risk, especially around HR data.  However, if your organization does not have this concern, then a multi-stage disposition just made the whole process much easier.

There are a couple of possible solutions for this:

1. For content that is highly sensitive within the organization, do not assign to many different SMEs.  Instead, leave that in the hands of the corporate record office/manager or the corporate record management team.  Let them export and send the list of documents for disposition in SiteA to User1 and SiteX’s documents to User2.  It’s a more manual process and is what the process likely was before multi-stage dispositions were released.  This allows for the ability to control the content for highly sensitive disposition reviews while still allowing for multi-stage disposition reviews to occur for less sensitive data.
2. Create a retention label for each site that needs that sensitive retention type.  For example, ADMIN374-ITSecurity and ADMIN374-HR.  While this seems like a really great way to achieve multi-stage dispositions without allowing information leakage, I really can’t recommend using this option unless your retention schedule has very few items.  A complex retention schedule’s file plan implemented in this way would very quickly balloon out of control.  You could easily triple the number of retention labels doing it this way.  So while I did list it as a possible solution to the dilemma mentioned above, I only recommend using it in very special circumstances.

 

Creating Multi-Stage Disposition Reviews

As I mentioned above, multi-stage disposition reviews are created on the retention label itself, just as they have always been in Microsoft 365.  In fact, the process itself is very straightforward.  Once you have created the retention label and configured the descriptors (if necessary), you will set up the label’s retention settings.  To configure the disposition review, ensure the option “Trigger a disposition review” is selected on the retention settings page of the label configuration.

The next screen will prompt you to configure the disposition reviews.

1. Click on “+ Add a stage (preview)”

Note: this is required even if creating a single-stage disposition review.

2. Give the stage a name.

3. Add a user or mail-enabled user group to the stage

4. Repeat the process for as many stages as required to a maximum of 5 distinct stages

Walking Through the Process

The process is much the same as the previous, single-stage disposition.  The difference here is that the different reviewers aren’t notified until it reaches their stage.  In the above example, Content SME 1 will receive the following email:

Clicking on the “Dispositions page” link will take Content SME 1 to the disposition review page for that label:

Just as in a single-stage disposition review, the reviewer can choose to dispose of the document (this sends the document to the next stage), change the retention label, or extend the current retention period on the document.

Once the disposition is approved by Content SME 1, the disposal process moves on to the Record Manager stage. The user is notified of pending dispositions (the email looks the same).  Clicking on the link takes the record manager to the same disposition review view as above. However, the stage name has now changed to Final Review as that is the stage the review is now in:

I personally think that the multi-stage disposition review is a good step in the right direction and will assist record managers in building better disposition processes. Still, I do think a few more refinements are in order.  Specifically, the ability to refine a label reviewer by the site.  However, this by itself is a great enhancement.

 

Thanks for reading!