In Microsoft Office 365 Dedicated/ITAR (vNext), a user assigns a personal tag from a retention policy that they wouldn’t typically have access to in Outlook Web Access (OWA). Then, the user can access additional personal tags in both OWA and Outlook.
This problem occurs if the MyRetentionPolicies role is added to a user’s role assignment policy.
To prevent users from seeing and applying any personal tag that's not associated with their retention policy in OWA, the MyRetentionPolicies role must be removed from the role assignment policy.
Users can also use the Exchange Administration Center (EAC) to select additional personal tags that aren't linked to their retention policy. The selected tags then become available in Outlook 2010 and OWA. To permit users to select additional tags from the EAC, you must add the MyRetentionPolicies role to the user's role assignment policy.