The confidential project file will not delete after the sensitivity label is removed

The situation: the label is gone, but the file remains

COMPOSITE SCENARIO: documented product behaviour combined with recurring operational failure patterns. No client-specific delivery claim is attached. Consider a Perth design and engineering consultancy closing a joint-venture project. Its SharePoint site carries a container sensitivity label that restricts unmanaged-device access. Working documents may also carry an item-level Client Confidential sensitivity label with encryption. A default retention label, Project record — seven years, is applied to a records library, while a broad site retention policy deletes ordinary project content after two years.

An administrator is asked to remove a superseded drawing immediately because it contains incorrect commercial information. They remove its sensitivity label, confirm the watermark disappears, and try to delete the file. SharePoint removes it from the ordinary library view, yet the content remains subject to retention. Another operator concludes that Purview is malfunctioning; a third proposes excluding the whole site from the retention policy.

Several independent controls govern the item: sensitivity protection, retention, record status and holds. It is a control-model failure: sensitivity was expected to govern lifecycle, a site policy was expected to override an item-level retention label, and disappearance from the user interface was mistaken for permanent deletion.

Contain the request before changing policy

Name the information owner, records authority and technical change owner. Record the exact file URL, item and version identifiers, site and library, current labels, requested disposal reason, legal or incident context, and the time the user attempted deletion. Preserve screenshots and audit events without copying the sensitive payload into an unrestricted ticket.

Do not remove the site from policies, delete labels, unlock records or apply a tenant-wide exception merely to make one file disappear. Do not promise permanent deletion until every applicable retention setting and hold is known. If the file presents an active disclosure risk, restrict access through the appropriate information-protection and SharePoint controls while the lifecycle decision is assessed; access containment and compliant disposal are separate actions.

The business question must be explicit: is this an ordinary superseded working file, a declared project record, material under investigation, or data that must be remediated under an exceptional approved process? The answer determines authority. It cannot be inferred from the user’s desire to delete it.

Separate the four control planes

Sensitivity labels classify and can protect supported content through encryption, markings and handling settings. A file or email can simultaneously carry one sensitivity label and one retention label. Sensitivity removal changes protection state only. The retention trigger and recorded event calculate the disposal date.

Container sensitivity labels can govern a Team, Microsoft 365 group or SharePoint site—privacy, external sharing and unmanaged-device access—but do not automatically apply the same item-level label to every document. Retention policies apply lifecycle settings implicitly at locations such as sites or mailboxes. Retention labels apply explicit item-level settings, can mark records, and can support event-based periods or disposition review.

A fifth plane may also apply: an eDiscovery hold preserves material independently. The diagnostic needs a joined map of item label, site or container label, retention policies, holds and disposition state. A Word label screenshot captures only one field.

Calculate the actual lifecycle outcome

For each applicable retention policy, retention label and hold, capture its scope, action, start trigger, period, record status and lock state. Microsoft calculates retention and deletion independently across the settings that apply to the item. By default, retention takes precedence over permanent deletion and the longest effective retention period wins. For deletion conflicts, an item-level retention label is explicit and its delete action takes precedence over retention-policy delete actions, but only after preservation requirements are satisfied.

Calculate dates from the configured trigger and captured event. The number printed in the label name is descriptive text. A five-year period starting from last modification can finish later than a seven-year period starting from creation. The event-based retention clock starts when the mapped event is recorded. An eDiscovery hold prevents permanent deletion until released. A Preservation Lock can prevent even administrators from disabling or weakening the associated policy.

In the composite case, the seven-year item-level retain-and-delete label remains decisive even after sensitivity protection is removed. The two-year site delete action can initiate removal from the active view, but cannot defeat the active retain action.

Build an item-level evidence map

1. Confirm the file’s current sensitivity label and whether encryption or markings remain.
2. Confirm any site/container sensitivity label separately.
3. Use Purview policy lookup and the exact site URL to identify scoped retention policies.
4. Inspect the item’s retention label, application method, start basis, record status and disposition action.
5. Check legal/eDiscovery holds with the authorised case owner.
6. Review Purview activity/content evidence and the Microsoft 365 audit trail for label, deletion and disposition actions.
7. For SharePoint, distinguish the user-visible library, recycle stages and secured preservation location.

Record both the configured period and calculated item dates. If the evidence cannot establish a single outcome, mark it unresolved; do not convert uncertainty into a deletion promise.

Choose the smallest authorised intervention

If the sensitivity classification is wrong, correct that classification under the information-protection procedure and test access. If the retention label is wrong but is a standard label, an authorised administrator may be able to relabel or remove it; the decision still needs records authority and an audit trail. If it marks a record, additional restrictions apply. A regulatory-record label cannot be casually removed. If a Preservation Lock applies, weakening the policy is intentionally unavailable.

If the item reached the end of retention and requires human review, use the configured disposition-review process and retain the reviewer decision. If the requirement is exceptional permanent deletion for a verified security, privacy or storage scenario, assess Microsoft’s supported priority-cleanup capability, its workload and licensing constraints, its incompatibility with records in relevant cases, and the organisation’s approval model. Use exceptional tooling only through the approved records-governance path.

For a design defect affecting a whole library, change the future application rule in a test scope first. Treat already-labelled items as a separate migration population; a new default leaves the historical item population unverified.

Verify both protection and lifecycle

Positive tests confirm that authorised users can open and work with the file, the intended sensitivity markings or encryption apply, the correct retention label and dates are visible to administrators, and disposal enters the configured review or deletion path. Negative tests confirm an unauthorised external or unmanaged-device persona cannot bypass protection, a working file is not accidentally declared as a record, and removing sensitivity does not silently alter retention.

Test one ordinary working document, one labelled record, one item under the broad site policy only, one item with overlapping settings, and—where authorised—one item at end of retention. Allow for documented propagation and timer-job intervals; do not classify an asynchronous control as broken after an immediate refresh. Verify audit events and secured copies without exposing their content.

Acceptance means another authorised operator can reproduce the applicable-control map, predict the lifecycle outcome, and explain why the visible file state differs from permanent-deletion state.

Prevent label vocabulary from becoming policy

Create a plain-language control dictionary: sensitivity answers how this information is handled; retention answers how long it survives and what happens next; record declaration answers what additional immutability and disposition evidence applies; DLP answers where sensitive data may move; eDiscovery answers what must be preserved for a case.

Design each policy from approved record classes and information risks, then test intersections with synthetic documents. Give labels names and descriptions that state the business rule without implying powers they do not have. Maintain a decision table mapping content class, owner, sensitivity, location, retention trigger, duration, end action, exceptions and evidence.

Practitioner discussions are useful for detecting propagation delays, confusing interfaces and undocumented symptoms. They do not override current Microsoft documentation or local item-level evidence. The durable repair is a control model that predicts outcomes before an urgent deletion request arrives.