Woodgrove Bank: Labels, Retention, and a Regulatory Inquiry
Woodgrove Bank has 12,000 employees and is subject to GDPR, PCI DSS, and a national banking regulator. Cardholder data appears in Exchange Online mailboxes and SharePoint sites despite a policy saying it should not. Of 3,000 documents carrying a sensitivity label, roughly 40 percent were labeled by users who picked the first option in the menu. A retention policy deletes all content in Exchange and SharePoint three years after creation. The bank has just received a regulatory inquiry covering 18 months and 14 named custodians, and separately noticed that a departing treasury analyst downloaded 900 files in the final two weeks of employment. The compliance team owns Microsoft Purview but has never run an eDiscovery case, and the legal team wants to know whether the three-year deletion policy will destroy evidence.
1. Which Purview control should fix the mislabeling problem, and how should the bank handle a conflict between a user-applied label and auto-labeling?
Read the worked answer
Use service-side auto-labeling policies built on sensitive information types and trainable classifiers, targeting the cardholder-data patterns, run first in simulation mode against the existing 3,000 documents to measure accuracy before enforcement.
Why not rely on users. A 40 percent error rate driven by menu position is a design failure, not a training failure. Remove the discretionary first option, set a default label for the libraries that hold cardholder data, and require justification when a user lowers a label.
Handling conflicts. Sensitivity labels have a defined priority order, and the higher-priority label wins when more than one applies. That means a lower-priority label a user applied manually can be superseded by a higher-priority auto-label, which is exactly the behavior that will surprise the compliance team if it is not stated. Configure label priority deliberately - the most sensitive cardholder-data label should sit highest - and validate the outcome in simulation and in Activity Explorer before enforcing.
Complement with DLP. Labels alone do not stop exfiltration. Add a DLP policy for credit card numbers, ideally with exact data match for the bank's own card ranges, blocking external sharing and email with a policy tip and an override requiring business justification.
2. Will the three-year deletion policy destroy evidence for the inquiry? Explain how to preserve the 18-month scope for 14 custodians and what takes precedence.
Read the worked answer
Deletion risk is real but manageable, and the answer is preservation rather than changing the retention policy wholesale.
Precedence. Content placed on hold through eDiscovery is preserved from deletion. If a mailbox or site is on hold, the retention policy's delete action is deferred for the held items, so evidence survives even though the policy still exists. Do not delete or modify the retention policy as the primary fix, because that alters records management across the whole bank and creates a new compliance problem.
What to configure. Create an eDiscovery case, add the 14 named custodians, and apply a legal hold to their Exchange mailboxes, OneDrive accounts, and relevant SharePoint sites. Confirm each custodian's hold status shows as applied, and confirm that shared mailboxes and Teams channel sites the custodians used are included - a common omission, since Teams content lives in SharePoint and Exchange behind the scenes.
Gaps to close. A hold preserves content that exists, not content already deleted before the hold. Preserve what remains, document the preservation date, and notify custodians in writing so downstream spoliation questions are answered. For future inquiries, pair retention labels with event-based retention and disposition review rather than a blanket three-year delete.
3. Walk through the eDiscovery workflow for the inquiry and identify where premium capabilities change the outcome. Also address the departing analyst.
Read the worked answer
Workflow. Create the case, add custodians, run searches scoped by date, custodian, and keywords, place holds, then promote results to a review set for filtering, redaction, and export. Each step is auditable, which matters when the regulator asks how the collection was performed.
Where premium changes the outcome. Custodian management and legal hold at scale across 14 people and their associated sites is the core premium value. In review, near-duplicate detection, email threading, and optical character recognition reduce 18 months of material to a defensible working set - OCR in particular matters for scanned loan documents. Analytics can prioritize relevance. Without these, the team reviews duplicates and image-only PDFs manually, which is where cost and missed evidence both come from.
The analyst. Treat this as a separate matter. Enable Insider Risk Management with the data-theft-by-departing-users template, using the HR connector for resignation signals and sequence detection for mass download. Coordinate with HR and legal before enabling, because policies affecting employees may require works council or union consultation in some jurisdictions. Preserve the analyst's mailbox and OneDrive immediately, and check whether the 900 files triggered existing DLP or audit events that were never triaged.