SharePoint archiving

Microsoft 365 Archive moves inactive data into a cold storage tier inside SharePoint. Archived content keeps the same searchability, security and compliance standards; a site keeps all its metadata and permissions when it is reactivated; and the whole thing is billed pay as you go (Microsoft 365 Archive documentation, read October 2026).

Read that list again and notice what it is about: sites. You archive a whole site, it stops being directly accessible, and you pay for the storage it consumes. That is a sensible answer to «our tenant is full of dormant team sites». It is not an answer to «prove to the auditor how long this contract must be kept and who destroyed the previous version».

One file plan over all cases, wherever the documents physically sit. Retention terms per case rather than per site. Destruction that runs automatically on expiry or by hand and leaves a signed report. Transfer to a state archive handled the same way. A full access log: who opened, changed, moved or destroyed a record, and when.

Inside Microsoft 365 that layer sits on softXspace365, our document management for Microsoft 365, which keeps documents, contracts and approvals where your people already work, in Teams and SharePoint. Outside it, the same file plan covers what SharePoint never held.

Nobody moves an organisation to a records programme in one release, and the attempts that try usually stall at the file plan approval. The working order is the other way round: take one group of cases that somebody is already accountable for, agree the terms for that group only, switch the log on, and let the first destruction run go through the full cycle including the report.

That gives two things at once. The auditor gets a complete answer about one area instead of a promise about all of them, and the rest of the organisation gets a working example rather than a policy document. Scope grows from there, and the dormant sites keep going to the cold tier on their own schedule, which is a separate decision and stays separate.

You choose. On your own servers, or in Azure in your own region. Data residency is usually decided by your regulator, your head office or your security team, not by a software vendor.

Cloud deployment carries the same access control and the same logging as an on-premises installation. Banks run audits against it, which is the only test of that claim worth anything.

If a request arrives to remove everything belonging to one person, that is configured to your rule rather than shipped as a switch: tell us how the request should be handled and we set it up.