Created by Claude - please verify

Retention coverage - Purview retention policies (Security & Compliance PowerShell) and each mailbox's holds (Exchange Online PowerShell).

Required Microsoft Graph permissions

Exchange.ManageAsApp Purview role for the app: Compliance Administrator (or a view-only compliance role) — application permissions, granted to the app registration with admin consent.

Licence: Microsoft 365 E3 or higher (retention policies); litigation hold needs Exchange Online Plan 2 or an archiving add-on.

Endpoints: Connect-IPPSSession (prefix Cc) · Get-RetentionCompliancePolicy -DistributionDetail · Get-EXOMailbox (LitigationHoldEnabled, InPlaceHolds, RetentionPolicy)

An org-wide policy does not apply to mailboxes it explicitly excludes (-mbx entries in InPlaceHolds). Retention labels users apply by hand are not counted. The MRM retention policy column is Exchange's older archive/delete policy and does not retain anything by itself.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Litigation Hold & Retention Coverage

If a mailbox is covered by no retention policy and no hold, a user can delete mail and it is gone for good after the recoverable-items window - including evidence. Mailboxes that nothing retains are listed first, together with whole locations (all sites, all OneDrives, all group mailboxes) no org-wide policy covers.