Is Microsoft 365 retention enough for SEC Rule 204-2?

Retention can keep the mail: an administrator creates a Purview retention policy covering each mailbox, your license lists it, and departures are handled before an account is deleted. Retention does not review mail. Whether a Microsoft-hosted copy meets (g)(2)(iii) is a separate compliance question for your firm.

That is Rule 204-2(g)(2)(iii), the separate-copy condition, quoted below.

What this means for your firm

• Open Purview and confirm a retention policy covers every mailbox in scope. Check what it counts from and add a margin over Rule 204-2(e)(1). Save a dated copy of its settings.
• Compare each user's license with Microsoft's service description before you rely on a feature.
• Before anyone leaves, decide how their mail will be kept: a hold on the mailbox before the account is deleted, or another route on Microsoft's delete-user page. Record who did it and when.
• Write down how your CCO reviews email, how often, and where the evidence lives.

Turret keeps a hashed, searchable copy of each monitored mailbox's sent and received mail outside Microsoft 365, and queues flagged outbound mail, with a written reason per flag, for your reviewer. No setup fee, and a 15-day free trial.

Six questions about how your firm keeps and reviews email: take the SEC email-readiness self-check.

Retention floor

Five years from the end of the fiscal year in which the last entry was made on the record, the first two years in an appropriate office of the adviser (Rule 204-2(e)(1)) [1]

Plans listed

Microsoft's Purview service description lists retention policies for Microsoft 365 E3, E5, A3, A5, G3, G5 and Business Premium, and for an Exchange mailbox also Exchange Plan 2 and Exchange Online Archiving (Microsoft Purview service description) [6]

Retention clock

For Exchange items, the age is based on the date received for incoming email, or the date sent for outgoing email (Microsoft Learn, retention settings) [5]

Rule 204-2 sets what an adviser keeps, for how long, and how electronic copies are stored. Paragraph (a)(7) names the mail:

"Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given;"

17 CFR 275.204-2(a)(7)(i)

Items (ii) to (iv) add funds and securities, orders and performance. Paragraph (e)(1) sets the clock:

"…shall be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser."

17 CFR 275.204-2(e)(1)

Which messages those subjects cover: see Which emails must an RIA keep? The retention period has its own answer: how long Rule 204-2 records are kept.

Purview retention policies are created by an administrator, and can retain content, delete it, or retain and then delete [3]. Outlook mail lives in Exchange Online [7]. Retention works in place: "if they edit or delete content that's included in the retention policy, a copy of the content is automatically retained." For Exchange, "The copy is retained in the Recoverable Items folder." [4]

Microsoft's Purview service description lists retention policies for Microsoft 365 E3, E5, A3, A5, G3, G5 and Business Premium. For an Exchange mailbox it also names Exchange Plan 2 and Exchange Online Archiving. Business Basic and Business Standard appear on that page only against Teams chats [6]. Check your plan against this list. A plan that is not listed is a question for Microsoft, not proof the feature is missing.

Licensing is per user: "Any user benefiting from the service requires a license." [6] Retention labels that start from an event, and adaptive scopes, are listed for E5-tier plans and are not listed for E3 or Business Premium.

Retention policies are created by an administrator. Microsoft's retention documentation is written for "IT administrators who can create retention policies and retention labels" [3]. For a policy applied to all mailboxes, "any new mailboxes created after the policy is applied will automatically inherit the policy" [5]. Exchange also applies the older Default MRM Policy to new users automatically. That is a different feature: its default tag moves items to the archive after two years, and it "doesn't include a DPT to automatically delete items" [8].

The clock. Microsoft: "For Exchange items, the age is based on the date received for incoming email, or the date sent for outgoing email." [5] Rule 204-2(e)(1) counts from the end of the fiscal year of the last entry, so a policy counting from the sent date can end up to a fiscal year earlier. That comparison is ours, not Microsoft's. Set a margin and write it down.

Paragraph (g)(2)(ii) asks the adviser to provide promptly what examiners request, and (g)(2)(iii) adds:

"(iii) Separately store, for the time required for preservation of the original record, a duplicate copy of the record on any medium allowed by this section."

17 CFR 275.204-2(g)(2)(iii)

The Microsoft pages cited here do not say whether a Microsoft-hosted copy meets (g)(2)(iii), or whether an export meets (g)(2)(ii).

What the export does: Microsoft's current eDiscovery export lets you "download mailbox items in PST files or as individual messages". "Search export packages expire 14 days after you create the export." [12]

What the plans say: the export page says to assign the eDiscovery user "a Microsoft 365 Enterprise E3 or E5 license" [12]. Microsoft's pages differ: its small-business pricing page says Business Premium "Includes data lifecycle management, eDiscovery, and audit" [13]. Ask your administrator, then test an export.

Rule 204-2 has no write-once requirement. Microsoft's SEC page covers rules "for the securities broker-dealer industry" and does not mention the Advisers Act or Rule 204-2 [14]. See Does SEC Rule 17a-4 apply to RIAs?

Not unless you keep it first. Microsoft says: "If you want to keep the user's email, BEFORE you delete the account, move the email to a different location." Otherwise, "You have 30 days to restore the account before the user's data is permanently deleted." [9]

Microsoft describes two routes that keep the mailbox.

A hold. A hold applied before the account is deleted converts the mailbox to an inactive mailbox. "If the hold isn't applied, the mailbox won't be converted", and a policy whose action is delete-only will not do it either [10].

A shared mailbox. Giving another user access to the deleted user's email "converts the deleted user's mailbox to a shared mailbox", and "A shared mailbox doesn't require a license." Microsoft also warns: "Don't delete a user's account if you've converted it to a shared mailbox." [9]

The Exchange Online service description marks inactive mailboxes "No" for Business Premium [11]; the Purview description says they "don't require a usage license" [6]. Ask Microsoft which applies to your plan. See also Does email archiving capture deleted email?

Rule 206(4)-7 is the compliance-program rule. Paragraph (a) asks for written policies and procedures reasonably designed to prevent violations; paragraph (b) asks for this:

"Review, no less frequently than annually, the adequacy of the policies and procedures established pursuant to this section and the effectiveness of their implementation"

17 CFR 275.206(4)-7(b)

Whether those policies include reviewing email, and how, is for your firm to set and document. Retention does no review. Microsoft's Communication Compliance can review mail, and its policies page describes "Outbound: Detects communications sent from scoped users to external and internal recipients, including other scoped users in the policy." It also describes inbound and internal directions [15]. Microsoft's plan page says covered users need a Microsoft Purview Suite license, an Office 365 E3 license with the Advanced Compliance add-on, or an Office 365 E5 subscription [16]. The Purview service description lists E5-tier plans and does not list Business Premium or E3 [6]. Confirm your plan before you rely on it. For a review cadence you can document, see How to review RIA email.

For retention, Microsoft 365 can be enough when all of these hold:

• A retention policy created in Purview covers the mail in scope, and each user's license lists the feature.
• The policy counts time with a margin over (e)(1), and a dated copy of its settings is saved.
• Departures keep the mail: a hold or another route from Microsoft's delete-user page is chosen before deletion, and who did it and when is recorded.
• You have run a test export and opened it to see that messages, attachments and dates are what you expect.
• You have decided, and written down, how (g)(2)(iii) applies to a Microsoft-hosted copy.

A firm that meets every condition should not buy anything because a vendor page says so. Review is a separate question: if your CCO reads or samples outbound mail and keeps dated evidence, that is a process you can document without a vendor. See Does a small RIA need email archiving? How an archiver connects: Microsoft 365 email archiving.

Turret keeps a copy of each monitored mailbox's sent and received mail outside your Microsoft 365 tenant, limited to what the mailbox still holds when Turret connects. Mail already archived stays for your retention period while you subscribe. Review is outbound-only: pattern checks, AI triage with a written reason, a reviewer queue, a Supervision Activity report. Turret does not capture texts. Turret does not walk the online archive mailbox or Recoverable Items. Email is $99 a month for 5 mailboxes, 15-day trial, no setup fee.

Sources opened October 27, 2026.

1. Cornell LII, 17 CFR 275.204-2, Books and records to be maintained by investment advisers
2. Cornell LII, 17 CFR 275.206(4)-7, Compliance procedures and practices
3. Microsoft Learn, Learn about retention policies & labels to retain or delete
4. Microsoft Learn, Learn about retention for Exchange
5. Microsoft Learn, Configure Microsoft 365 retention settings to automatically retain or delete content
6. Microsoft Learn, Microsoft Purview service description (dated August 3, 2026)
7. Microsoft Learn, Exchange Online
8. Microsoft Learn, Default retention policy in Exchange Online
9. Microsoft Learn, Delete a user from your organization
10. Microsoft Learn, Learn about inactive mailboxes
11. Microsoft Learn, Exchange Online service description
12. Microsoft Learn, "Export search results in eDiscovery" (ms.date June 23, 2026)
13. Microsoft security pricing for small and medium business (microsoft.com)
14. Microsoft Learn, SEC Rule 17a-4, SEC Rule 18a-6, FINRA 4511, & CFTC 1.31 (Microsoft Compliance)
15. Microsoft Learn, Manage Communication Compliance policies
16. Microsoft Purview, Plan for Communication Compliance