Audit Log Retention Policies

Audit log retention policies in Microsoft 365 control how long unified audit logs are preserved in the Microsoft 365 compliance center. These logs record user and admin activities across Exchange Online, SharePoint Online, OneDrive for Business, Azure Active Directory, Microsoft Teams, Power BI, and other workloads. The retention policy determines the duration from the time the activity occurred until the log is automatically deleted. The default retention period is 180 days for most Microsoft 365 subscriptions (E3, Business Standard, etc.), but organizations with an E5 license or add-on compliance licenses can retain logs for up to 10 years (3650 days) or even indefinitely with a custom retention policy.

Organizations must retain audit logs to meet regulatory requirements such as GDPR, SOX, HIPAA, or internal data governance policies. Retention policies ensure logs are available for forensic investigations, eDiscovery, insider risk management, and compliance audits. Without proper retention, logs may be deleted before they are needed, leading to compliance violations or inability to investigate security incidents. The SC-900 exam tests your knowledge of default retention values, which workloads are audited, and how to configure retention using the Microsoft Purview compliance portal or PowerShell.

When an audited action occurs, the Microsoft 365 service generates an audit record and sends it to the unified audit log. Each record includes a timestamp (CreationTime), the user who performed the action, the workload, and details about the operation. The retention policy is applied by a background process that evaluates the CreationTime of each record against the configured retention duration. Records older than the retention period are permanently deleted from the audit log store. This process runs periodically (typically every few days) to purge expired logs. The deletion is irreversible—once deleted, logs cannot be recovered unless they were exported or stored elsewhere.

You configure audit log retention in the Microsoft Purview compliance portal under Audit > Audit retention policies. Alternatively, you can use the following PowerShell cmdlets:

To check the current retention duration in the portal: navigate to Audit > Retention policies and view the policy. You can also create a custom retention policy with a specific duration (in days) and assign it to specific workloads or all workloads.

Audit log retention works closely with: - eDiscovery: eDiscovery holds can preserve audit logs beyond their retention period. If a legal hold is placed on a user or site, associated audit logs are protected from deletion. - Retention labels and policies: These are for content (documents, emails) not audit logs. Audit log retention is separate. - Alert policies: Alert policies can trigger based on audit log events, but they do not affect retention. - Microsoft 365 Defender: Some security events are also recorded in the unified audit log, but Defender has its own retention for advanced hunting (30 days).

The policy takes effect within 24 hours. Existing logs are not retroactively affected—only new logs generated after the policy is applied will have the new retention. To change retention for existing logs, you must use a different method (e.g., export logs before they expire).

# Connect to Exchange Online PowerShell
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Set unified audit log retention to 365 days
Set-AdminAuditLogConfig -UnifiedAuditLogRetentionDuration 365

# Verify
Get-AdminAuditLogConfig | Format-List Name, UnifiedAuditLogRetentionDuration

If you cannot set retention beyond 365 days, verify your license includes the Microsoft 365 E5 Compliance add-on. Also ensure the user configuring the policy has the Audit Log role in the compliance center.

A financial services firm is subject to SEC regulations requiring retention of all communications and activity logs for at least 7 years. They have Microsoft 365 E5 licenses, which allow up to 10 years of audit log retention. The compliance team configures a custom retention policy set to 2555 days (7 years) for all workloads. They also enable auditing for all users. The policy ensures logs are automatically deleted after 7 years, reducing storage costs. However, they must monitor storage quota—with 5000 users, the 100 GB quota may fill in less than 7 years. They mitigate this by exporting logs annually to Azure Blob Storage using the Management Activity API. The exported logs serve as a backup in case of accidental deletion. Common mistake: setting retention to 10 years without considering storage quota, leading to logging interruptions.

A hospital uses Microsoft 365 E3 licenses and needs to retain audit logs for 6 years per HIPAA. E3 default retention is 90 days, so they purchase the Microsoft 365 E5 Compliance add-on to enable up to 10 years retention. They configure a custom retention policy for 2190 days (6 years). They also enable auditing for all healthcare workers. The compliance team runs monthly reports to verify that audit logs are being generated and retained. They also set up alerts for when storage usage exceeds 80% of the quota (50 GB for E3). When the quota is nearly full, they export old logs to an on-premises archive. A pitfall: they initially set retention on Exchange and SharePoint but forgot Azure AD, which has separate audit logs. They later discovered that Azure AD logs were only retained for 30 days, causing a gap in user activity records. They corrected this by selecting Azure Active Directory in the retention policy.

A global company has subsidiaries in the EU (GDPR requires 3 years) and the US (SOX requires 5 years). They use Microsoft 365 E5 licenses. They create two custom retention policies: one for EU users with 1095 days (3 years) and one for US users with 1825 days (5 years). However, audit log retention policies cannot be scoped by user geography—they apply to workloads globally. To achieve regional compliance, they use separate tenants for each region (not ideal). Alternatively, they export logs for EU users to a separate storage and delete them after 3 years using a custom script. This is complex and error-prone. The exam does not test multi-geo scenarios in depth, but it highlights that retention policies are tenant-wide for each workload. For SC-900, remember that you cannot set different retention for different users in the same tenant—only different workloads.