---
title: "Why Microsoft lets another organisation delete our records"
url: https://endomint.com/p/ysoVhbb86HIo1Wy3TEJ6Xw/why-microsoft-lets-another-organisation-delete-our-records
published: 2026-11-05
updated: 2026-11-05
tags: ["deletion", "governance", "microsoft", "records", "retention", "teams", "vendor"]
---

# Why Microsoft lets another organisation delete our records

A work chat my organisation created was running for about a month. Then the older messages disappeared, and Microsoft Teams told every member of the conversation why: **"Older messages were deleted due to an org's retention policy."**

Our own IT could not find a group chat deletion policy of ours that accounts for it. The behaviour we were pointed at belonged to a retention setting held by a participant from another organisation.

So the question is for Microsoft: why would you build Teams so that a retention setting we do not control, do not own and cannot see can empty a chat we created, inside our own tenant, before anyone who owns the records has assessed a single one of them?

## The analogy I would use with Microsoft

I am a visitor to your house, and I will throw away your food in your fridge if it is more than 2 days old because that is how I run it.

Nothing in that sentence makes the food mine. It makes the fridge mine, for as long as I am in your house. My housekeeping rules are sensible for my own kitchen. Applied to yours, they destroy things you were counting on, and you never got a say in the rule that did it.

You built the fridge, and you built the timer that sits in it. You decided the timer runs whatever the householder wanted, and the householder is told afterwards, in the room where the food used to be, that the food is gone.

That is the shape of the problem. The chat was ours, and the messages in it were about our work. The setting that emptied it belonged to someone else, and it applied to our messages before anyone who owns the records had assessed a single one of them.

## What the retention setting decided that it should not have

The chat was being used to coordinate progress claims, so what went missing was requests, clarifications, who was responsible for what, decisions and the actions that followed. Whether any one message is a formal business record depends on its content and the business context around it. Message age cannot tell you.

| The retention setting asked | The information owner has to ask |
| :-: | :-: |
| How old is this message? | What activity does this record evidence? |
| Whose retention setting applies? | Which organisation is accountable for that activity? |
| Can this be deleted now? | Which disposal class applies, and who authorised it? |

## What I am asking Microsoft to do

- Tell the creator of a chat when a participant from another organisation holds a retention setting that can reach their messages, before it does and when it does.
- Stop a retention setting in one organisation removing messages from a chat created in another. Where that cannot be done, give the chat owner the decision.
- Say which organisation's setting caused a deletion, so the owner of the affected records is not left reconstructing it from a chat message.
- Give the owner of a chat a way to preserve what is about to go, while it is still there to preserve.
- Say plainly in the documentation that this behaviour exists, so that the people who configure these settings know what they are reaching into.

The ask is narrow: the platform should stop deciding, on our behalf, that our records are disposable.

## What we are fixing on our side

The other organisation's setting may well have been put there for good reasons. Security, privacy and minimisation are legitimate goals, and none of them require one organisation's policy to reach quietly into another organisation's records.

We are also moving substantive work out of mixed-organisation group chats and into channels we own. A channel only counts as a control if it has a named owner, an agreed retention setting, a way to capture what matters and a closure process. Those are governance arrangements, and they are ours to make. Containment is not the same as a control.

## Why I am asking Microsoft to answer this

Custody of the platform is not ownership of the record. Record keeping obligations sit with the organisation accountable for the activity, and disposal of those records should follow an authorised decision made by that organisation, not a default that arrived with somebody else's login.

You can build a product where the party with the shortest retention setting decides what happens to everybody else's evidence, and call it working as designed. Or you can build one where the organisation that created the conversation keeps control of it, and the policy of a guest stops at the door.

~ Mike