* Content is shared from Microsoft 365
This rule will detect if one of your employees is sharing sensitive info outside of your organization.
* Content contains
Messages or documents that contain sensitive information as defined by Microsoft Purview Data Loss Prevention (DLP) policies.
Reference:
https://learn.microsoft.com/en-us/purview/dlp-exchange-conditions-and-actions

The requirement states that all Microsoft 365 data for users must be retained for at least one year. In Microsoft
365, retention policies must be configured for each type of data storage.
Step 1: Identifying Where Data is Stored
From the case study, users store data in the following locations:
# SharePoint Online sites
# OneDrive accounts
# Exchange email
# Exchange public folders
# Teams chats
# Teams channel messages
Since these locations fall under two broad categories:
# Microsoft Exchange data (Emails, Public folders)
# SharePoint, OneDrive, and Teams data
Step 2: Required Retention Policies
1#. A single retention policy can cover:
# SharePoint Online
# OneDrive
# Microsoft Teams
2. A second retention policy is required for:
# Exchange (Emails & Public Folders)
Thus, the minimum number of retention policies required to meet the requirement is 2.
Microsoft 365 retention policies can be applied broadly across multiple services with just two policies:
# One for Exchange & Public Folders
# One for SharePoint, OneDrive, and Teams
There's no need for separate policies for each individual workload unless different retention durations are required, which is not stated in the requirement.