I'm trying to wrap my head around the Site Policies and the Site Closure and Deletion in SharePoint Online for non-Self Service created sites. It seems like it is nice in theory but looks like it is easily bypassed.
As a SCA (and global admin in O365), I can go in and create the policies. No problem. I can then assign the policy to the site. Since this Closure and deletion is under Site Administration, anyone listed in the owner group can simply remove the policy in place by setting it to No Site Policy.
We want to be able to use this feature to enforce retention, but this seems like a gaping security hole. What if any workarounds are out there? Remote CSOM on timers to check and set it every day if it is not found?
This seems to be reinforced here.