4-page Case Study
Posted: 10/24/2013
Rate This Evidence:

Microsoft Corporation Microsoft Boosts Records Management with Built-in Features of Collaboration Solution

Microsoft is using the native capabilities within Microsoft SharePoint 2013 as the foundation for a holistic, global records management methodology. After consolidating 3,600 retention categories into eight overarching categories aligned to its business groups, Microsoft used SharePoint Records Center as a central repository to support its entire records management process, including unified physical and digital records, on-premises and in the cloud, and from collection through disposition. Microsoft benefits from core capabilities within SharePoint Records Center by expediting merger and acquisition records management, improving records management adoption, standardizing business processes, and improving employee productivity.

With more than 95,000 employees working in countries around the globe, corporate records management at Microsoft Corporation is a monumental task. Employees create tens of thousands of digital and physical documents every day in online collaboration sites and offices in countries with varied legal compliance requirements.

Business groups had different approaches to records management, with many employees using manual processes that contributed to silo-based records management inefficiencies throughout the company. For example, within one Microsoft division there were two groups that had records management inefficiencies: one example being the lack of an electronic repository for documents, resulting in more than 10,000 records existing as physical documents in file folders. Managing this amount of paper made it challenging for staff to consistently enforce retention policies. Even when documents were retained as digital files, the issues related to records management were complex and difficult to assign.

* In SharePoint Records Center, Microsoft has a scalable and functional records management solution that delivers compliance-driven, self-service document, records, and contract management solutions. *

Nishan DeSilva
Senior Director, Business and Technology Solutions, Microsoft Legal and Corporate Affairs

Underlying these issues was an inconsistent understanding within Microsoft about how to apply established records management policies and guidelines. There was a varied understanding of what constitutes a record, how best to make use of the Corporate Retention Schedule, how to assign category and retention, and how digital records should be stored.

“We saw a huge opportunity at Microsoft to reevaluate and overhaul our approach to records management,” says Nishan DeSilva, Senior Director of the Business and Technology Solutions team for Microsoft Legal and Corporate Affairs (LCA). “To mitigate risk and meet our records retention and compliance requirements, reduce duplication of effort, minimize storage costs, and find records faster, we needed to rethink how we were doing records management from the ground up.”

The Business and Technology Solutions team began to reevaluate how Microsoft approaches records management beginning in 2009 when DeSilva and his colleagues introduced a holistic, end-to-end view of records management. Instead of simply buying and deploying a third-party technology solution that promised to automate the process of records management, the team determined that a truly innovative solution was required. Any solution that was deployed needed to be compliance-driven and able to work in concert with the subtleties of law and ever- changing data landscapes as understood by the records management professionals at Microsoft.

“Today, we look at records management as a business issue that should be solved through a strategy that focusses on understanding the policies that you need to apply to your records, and then streamlines your business processes around managing those records,” says DeSilva. “The final step is to configure your technology solution. For the last three years, we have been applying this approach at Microsoft by using the Records Center repository in Microsoft SharePoint Server to deliver records management solutions that contain flexible taxonomies for our different business groups.”

SharePoint Records Center serves as a central repository to store and manage all of an organization’s records. It supports the entire records management process, from collection through disposition, and includes core capabilities such as versioning, auditing, holds, metadata management, eDiscovery, and customizable record routing, which can be customized to meet individual organization’s file plans.

Core capabilities within SharePoint provide the functionality that enables the Business and Technology Solutions team to:

  • Create a unified plan for storage of physical and electronic documents.

  • Unify retention schedules across all electronic and physical documents.

  • Manage active files and off-site services.

  • Create, search, and retrieve records, and store them offsite if needed—all from one central location.

  • Create a unified process for retention and disposal of records.

Within SharePoint Records Center, automated disposition can be handled by custom workflows that are executed when an event stage is activated based on the records retention time period. As a result, the rules for many of the records retention categories can be customized through SharePoint Information Management Policy settings. From there, it is possible to set single or multiple retention stages, along with recurrence periods. Once the workflows are executed, email messages can be sent to reviewers, such as records managers, for approvals or resets. Each workflow can be customized for each records series based on functional business needs.

LCA uses SharePoint Server 2010 and SharePoint Server 2013 on-premises and, more recently, SharePoint Online in Microsoft Office 365 as a central repository to store and manage records. “Before we got to this point, we had to come to an understanding that corporate records management is not just a program that runs; it’s a process that we are introducing across the company to transform how we approach records management,” says Joe Do, a Program Manager on the Business and Technology Solutions team for Microsoft Legal and Corporate Affairs.

Consolidate Retention Policies
In 2006, Microsoft had more than 3,000 retention categories—a legacy of traditional document retention strategies. “We moved away from granular retention policies to develop eight overarching content categories based on our eight primary business functions and two other specific categories based on distinct legal obligations: compliance and contracts,” says Rachael Heade, Senior Program Manager on the Business and Technology Solutions team for Microsoft Legal and Corporate Affairs. “Then we defined a set of 64 sub-classifications within those eight categories. This is a very small number for a corporation our size but still allows us to map to international regulatory requirements and any unique legal obligations that we have. It also makes it much easier for employees to map and categorize their documents properly for retention.”

* The flexibility of SharePoint is great because employees can continue to search for and use critical documents without compromising the documents’ records status. *

Joe Do
Program Manager, Business and Technology Solutions, Microsoft Legal and Corporate Affairs

For example, instead of setting different retention policies for technology adoption contracts, revenue contracts, and non-revenue contracts, Heade and her colleagues consolidated them all under a “Contracts” content type that has one retention policy. However, when necessary, the approach allows for unique categories such as non-disclosure agreements which are evergreen and therefore permanent. Office documents, PDF files, TIFFs (scanned images), email messages, structured data in systems, and physical records are all classified based on business function and content, not format. This allows for retention consistency between varying formats.

As a next step, Do defined sub-classifications of different kinds of contracts using metadata—not for retention purposes but to facilitate search and retrieval. “This approach to categorization adapts perfectly to SharePoint Records Center,” says Heade. “We have the flexibility to make use of broad categorization when it is most effective, and we can take it down to that granular level when that type of precision is needed.”

After consolidating and refining the corporate retention schedule for the entire company, Heade and her colleagues on the Policy and Compliance Group were able to more effectively assist individual business groups in complying with Microsoft retention requirements because it was easy to determine which documents and files should be kept as records. The key to an effective and compliant records management solution is defined governance policies that enable a consistent, streamlined approach to the entire records management cycle and can be reused, with some customization, across most business groups.

The Business and Technology Solutions team went beyond the traditional understanding of a record as a document that references a legal obligation. This approach excludes a great deal of the important, business-driven retention requirements around intellectual property and the iterative, conceptual stages of creative product development that occurs at Microsoft. “When it comes to determining what is a record, I ask: ‘Is this the document that in the future I will use to tell what you did in the past definitively?’” says Heade. “For us, it could be source code, R&D notes, functionality testing, or bug tests. Again, SharePoint gives you the flexibility to look at what’s critical to your business and define your records accordingly.”

Streamline Business Processes
Once a business unit has adopted the applicable corporate records and retention policies, it can take advantage of Lean Six Sigma expertise within the LCA Business Services Group to help streamline its business processes around managing those records. “With records management, it’s critical that you look at the entire process from end-to-end, not just internally, and determine what are the inputs and outputs,” says Joanna Elazrak, Senior Program Manager on the Business and Technology Solutions team for Microsoft Legal and Corporate Affairs. “First, you need to identify business and legal requirements and retention policies; then establish business processes that work towards those needs; and finally, develop technology to support your business processes and policies, not the other way around.”

A certified Black Belt in Six Sigma Methodology, Elazrak helps business units see how they can handle their records more efficiently. She notes that every group has different processes that are often manual, redundant, and costly. “We needed to standardize on best practices as much as possible across the organization,” she says. “So we conducted a similar exercise for each group, looking at how people work with their documents and identifying non-value add activities, such as printing out digital records unnecessarily. We also help business groups develop and expedite processes to upload or submit documents for storage: physical or digital, onsite or offsite.”

The LCA Records Team conducts a small pilot with each business group that they work with to ensure recommended processes are being followed. Today, the group is close to developing companywide standardized electronic records management processes. “With SharePoint Records Center, we have enough experience to know that the processes and the technology we have will deliver what the company needs,” says Elazrak.

Deploy SharePoint Records Center
Joe Do and his colleagues in the Solution Delivery and IT team in LCA are responsible for implementing SharePoint Records Center to accommodate the business groups as they evolve their records management policies and processes. Microsoft has been taking a “crawl, walk, run” approach to introducing business groups to the new records management methodology and to migrating their records to SharePoint Records Center. “When it comes to operationalizing our records management policies, we are taking a risk-based approach,” says DeSilva. “We work with our mergers and acquisitions; focus on legal, financial, and HR functions; and then work with business groups as needed, depending on specific compliance or audit issues.”

Today, LCA uses a Records Center server farm in SharePoint 2010 (soon to be upgraded to SharePoint 2013) that is capable of scaling to 200 terabytes. It currently contains 40 terabytes of data, and Microsoft expects an annual growth of 5 terabytes. “Our on-premises server farm reflects how we manage and intake records from a hybrid perspective,” says Do. “While SharePoint Records Center is capable of in-place records management, Microsoft uses a hybrid process whereby an employee can send a record to Records Center either directly from a SharePoint collaboration site or through a record clerk who reviews the document. A link is left on the site so that people can access the document, but it is locked and retained on the database. The flexibility of SharePoint is great because employees can continue to search for and use critical documents without compromising the documents’ records status.”

* For us, the proof is in the progress we have achieved so far: you get records management functionality natively with SharePoint Records Center. *

Nishan DeSilva
Senior Director, Business and Technology Solutions, Microsoft Legal and Corporate Affairs

Do and his colleagues architected SharePoint Records Center to support the broad retention policies that Microsoft uses, while enabling the company’s service level agreements. For each content type, such as the “Contracts” category, they created multiple content databases, or site collections of 250 gigabytes. These are much easier to back up and restore.

“We have content spread across multiple databases or site collections, but we set up a central portal for customers to search and access the records,” says Do. “And because all the sub-classifications are metadata driven, employees quickly get efficient, accurate search results.”

Do also configures metadata fields, information management policies, event-based retention schedules, and disposition workflows. “We do everything we need for records management in SharePoint right out-of-the-box,” he says. “Take automated disposition, for example. At Microsoft, we can do this without having to create custom code. We can use SharePoint workflows created in SharePoint Designer. We can specify that when a record comes up for disposition, an email notification that contains a link to the record is routed to a records manager, who reviews the document and either approves the disposition or resets it.”

Support Records Management Capabilities in the Cloud
LCA is also using SharePoint Records Center to manage records in the cloud. Today, there are many terabytes of data stored in SharePoint Online, a component of the Office 365 cloud-based business productivity offering, and Do’s team is developing a records migration strategy to eventually move more than a petabyte of data to the cloud.

“This is a best practice that will save significant hardware and infrastructure management costs in the long run, but there are many considerations with proprietary systems and business processes that depend on on-premises implementations,” says Do. “However, we are making progress because SharePoint Server 2013 offers complete records management and eDiscovery in the cloud. It allows you to surface the records you need through a single portal, whether they are stored on-premises or in the cloud.”

Bring in Partners as Needed
The Business and Technology Solutions team is also deploying a unified records management solution that brings together physical and electronic records. Within the entire records management function at the company, this is the only point at which Microsoft works with third-party vendors. It chose Iron Mountain to help manage its physical records and Gimmal to build a sustainable unified management solution.

“We met with the Iron Mountain team and worked together to optimize the processes around how they manage our physical records offsite,” says Elazrak. “We identified some overlap and duplication of work and were able to improve our instance of Iron Mountain’s cloud-based tool. Now, when I talk to the business groups that have physical records, we provide a couple of different ways to route those documents offsite for storage. The Iron Mountain team is then responsible for inputting those documents with the correct labels and retention polices.”

Since 2009, the Microsoft Legal and Corporate Affairs group has used Records Center in SharePoint Server 2010, SharePoint Server 2013, and SharePoint Online to support an evolving and maturing records management solution—on-premises and in the cloud—throughout its business. “For us, the proof is in the progress we have achieved so far: you get records management functionality natively with SharePoint Records Center,” says DeSilva.

Today, there are dozens of business units, representing more than 95,000 Microsoft employees, using SharePoint Records Center to meet the company’s record retention legal obligations. These business units are managing physical and electronic records with the same consistency, and they are lowering the risk of non-compliance. “In SharePoint Records Center, Microsoft has a scalable and functional records management solution that delivers compliance-driven, self-service document, records, and contract management solutions,” says DeSilva.

Expedites Merger and Acquisition Records Management
For Microsoft, SharePoint Records Center has already proved its value in expediting records management for acquisitions; a specific example involved the recent acquisition of Skype. The Skype legal team had used a 5,000-line spreadsheet to manage 5,000 contracts that were stored in disparate repositories around the company, in both digital and physical format. Working together, Do and Heade faced the challenge of how to bring these records into the SharePoint Records Center environment without disrupting the business.

“We set up a SharePoint Records Center just for Skype, scanned all their contracts, and moved over the metadata so that employees could search and work with the documents as usual. We secured and set permissions and attached the retentions on the back end—and we did this all in two weeks,” says Heade. “So in the midst of the usual confusion and upheaval of an acquisition, we used SharePoint Records Center to establish a legacy solution and a go-forward solution at the same time. That’s pretty powerful.”

Improves Records Management Adoption
Thanks to the flexibility built into SharePoint Records Center, employees work in a full digital environment—collaboration, access, and storage are all a click away. By using SharePoint Records Center it is easy to create a seamless flow between how employees work and how employees participate in records management. Employees don’t have to worry about categorizing or assigning proper retention times. By uploading a document into a records center all of the retention requirements are handled by the solution.

* The way we have architected SharePoint Records Center, I know that the right retention and the right document categorization will take place. That’s invaluable. *

Rachael Heade
Senior Program Manager, Business and Technology Solutions, Microsoft Legal and Corporate Affairs

“The SharePoint solution is elegant, but equally important, it is familiar,” says Heade. “Today, there are 95,000 people at Microsoft who know and use SharePoint, so using SharePoint Records Center has a common feel, look, and functionality of other locations they are collaborating and doing their work. This consistency improves the uptake of our records management solution.”

Improves Productivity for Business Users
Working with Gimmal and Iron Mountain, Microsoft gains centralized management of its physical and electronic records making it easier to apply one set of policies that govern access rights, retention periods, and destruction protocols for all information, regardless of where it’s stored. As a result, Microsoft employees can find records faster. Microsoft can also reduce the risks of noncompliance and decrease storage costs.

“The unified view provided by this solution is critical from a business process perspective, providing the ability to seamlessly organize, access, and apply policies across all of our content,” says DeSilva. “By integrating both physical and electronic content through Iron Mountain, we can improve productivity to our business users and gain tighter control over our information for compliance, electronic discovery, and disposition purposes.”

Standardizes Processes
By establishing one set of policies that governs access rights, retention periods, and disposal protocols regardless of where the information is stored, Microsoft has a standardized, optimized records management function wholly supported by SharePoint Records Center. “As the records manager in charge of compliance and policy and the application of that across Microsoft, I know that if someone at this company sets up a Records Center with Do’s team, I don’t have to worry whether it’s complaint,” says Heade. “The way we have architected SharePoint Records Center, I know that the right retention and the right document categorization will take place. That’s invaluable.”

Microsoft has developed an approach to records management that goes beyond simply finding and deploying a technological solution. SharePoint Records Center is an integral part of this approach because it provides retention requirements on the back end that are driven by the unique legal obligations and critical business needs of Microsoft.

The company is on its way to achieving consistent retention compliance across formats and improved access to documents by people when they need them. Because SharePoint Records Center applies retention on the back end and is mapped to the retention schedule, electronic documents are being retained for the same amount of time as their physical counterparts, which are also mapped to the retention schedule. As a result, Microsoft can really focus on content and business function as the starting point for determining retention drivers. And SharePoint Records Center stands ready to take on more, thanks to improvements in eDiscovery and the integration of unified records management adding up to an end-to-end records management solution that’s flexible enough to satisfy record management at Microsoft.

SharePoint is the new way to work together. A simplified user experience helps you organize, sync, and share all your content. New social capabilities make it easy to share ideas, keep track of what your colleagues are working on, and discover experts you never knew existed.

For more information go to:

For More Information
For more information about Microsoft products and services, call the Microsoft Sales Information Center at (800) 426-9400. In Canada, call the Microsoft Canada Information Centre at (877) 568-2495. Customers in the United States and Canada who are deaf or hard-of-hearing can reach Microsoft text telephone (TTY/TDD) services at (800) 892-5234. Outside the 50 United States and Canada, please contact your local Microsoft subsidiary. To access information using the World Wide Web, go to:

For more information about Gimmal products and services, visit the website at:

For more information about Iron Mountain products and services, visit the website at:

Solution Overview

Organization Size: 99000 employees

Organization Profile

Based in Redmond, Washington, Microsoft Corporation develops, manufactures, licenses, and supports a wide range of products and services related to computing. It employs approximately 95,000 people.

Software and Services
  • Microsoft SharePoint Server 2013
  • Microsoft SharePoint Server 2010
  • Microsoft Office 365
  • SharePoint Online

Vertical Industries
  • High Tech & Electronics
  • IT Services

United States


Gimmal Group Iron Mountain