Microsoft 365 audit retention is normally 180 days under Audit (Standard). Audit (Premium) provides 1-year retention for qualifying Exchange, SharePoint, OneDrive and Microsoft Entra records, but the entitlement depends on the user generating the activity.
An E5 subscription somewhere in the tenant does not give every account the same retention. Per-user licensing, record type and matching policies determine which period applies.
Start by separating the default duration from the policies and licences that can change it.
Key Takeaways
- Audit (Standard) normally retains records for 180 days. Audit (Premium) retains qualifying Exchange Online, SharePoint, OneDrive and Microsoft Entra records for one year when the user who generated the activity has an eligible licence.
- An E5 subscription in the tenant doesn’t give every user the same retention. The generating user’s licence, the record type and the matching policy determine the period.
- When custom policies match the same record, the policy with the lowest numerical priority wins. Policies aren’t retroactive, and a custom policy can shorten retention by taking precedence over the default.
- Microsoft Entra sign-in logs and Insider Risk alerts and cases have separate retention rules. External archiving requires continuous collection, monitoring and a tested retrieval process.
Compare the default retention periods
Audit (Standard): 180 days
The default audit log retention policy for Audit (Standard) retains audit records for 180 days. The older 90-day period applied to records generated before 17 October 2023; it is not the standard duration for newly generated records.
Records generated by users without qualifying E5-level or Audit (Premium) entitlement, and by guest users, normally receive 180-day retention. A longer policy does not remove the licensing requirement.
Audit records describe supported activity. They do not provide an independent means of restoring deleted messages or documents, which requires separate consideration of Microsoft 365 backup and recovery.
Audit (Premium): 1 year for qualifying workloads
Audit (Premium) has a default, non-editable policy retaining qualifying Exchange Online, SharePoint, OneDrive and Microsoft Entra audit records for one year. Other workloads normally remain at 180 days unless an applicable custom policy extends them.
Microsoft’s audit retention policy guidance also distinguishes non-user activity. Records generated by service principals and system events have fixed 1-year retention that custom policies do not change.
Match each retention period to its licence
Retention is assessed against the entitlement of the user whose activity generates the record. An administrator’s E5 license doesn’t extend retention for activity performed by colleagues without that entitlement.
The available periods have different licensing requirements.
| Retention period | Licensing requirement |
|---|---|
| 180 days | Audit (Standard); also the normal period for guests and users without qualifying Premium entitlement |
| 7 or 30 days | Microsoft 365 Enterprise E5 |
| 6 months, 9 months or one year | Eligible Audit (Premium) licensing |
| 3, 5 or 7 years | E5 plus the 10-Year Audit Log Retention add-on |
| 10 years | E5 plus the 10-Year Audit Log Retention add-on |
Eligible Premium entitlements include Microsoft 365 E5, Office 365 E5 and qualifying audit add-ons. The 10-year add-on license is also required for the 3-, 5- and 7-year options; selecting a shorter multi-year duration doesn’t avoid that requirement.
Budget for the users whose activity generates audit records that need extended retention. External archiving introduces separate collection, storage and administration costs.
Choose the period based on investigation needs, contractual obligations and the organisation’s documented retention schedule. A 7-year policy defines a technical retention period; it doesn’t establish that every audit record must legally be kept for 7 years.
Understand which audit retention policy wins
Priority takes precedence over duration
An organisation can create up to 50 custom audit log retention policies. Priority values run from 1, the highest, to 10,000, the lowest.
When multiple custom policies match a record, the policy with the lowest numerical priority wins. Custom policies also take precedence over the default audit log retention policy. The longest period does not automatically take priority.
For a qualifying E5 user with the add-on, a matching Microsoft Teams policy retaining records for 10 years at priority 100 takes precedence over a matching 1-year policy at priority 200.
Reverse those priorities and the 1-year policy wins. Review user scope, record types and priority together.
New policies do not extend earlier records
Audit retention policies are not retroactive. A policy created today cannot extend retention for records generated before its creation, even when those records remain searchable.
Assign the required licences and establish the policy before generating activity that needs longer retention. An upgrade cannot reconstruct records that have already expired.
A custom policy can shorten retention because it overrides the default. Treat priority changes as changes to evidence preservation, not routine housekeeping.
Create and manage the policy in Microsoft Purview
Configure the policy in the portal
Use an account with the permissions required to manage audit retention policies. Define the intended users, activities, duration and priority before creating the policy.
In the Microsoft Purview portal, follow these steps:
- Select Solutions, then Audit.
- Open Audit retention policies and select Create audit retention policy.
- Enter a meaningful name and description, then select the relevant users and record types.
- Choose the retention duration and assign a priority that reflects existing matching policies.
- Save the policy and review its scope alongside the other policies in the dashboard.
A description should explain the business requirement and policy owner. Naming a policy after a department alone doesn’t explain why its records need a particular duration.
Manage policies through PowerShell
Connect to Security and Compliance PowerShell using Connect-IPPSSession. Create policies with New-UnifiedAuditLogRetentionPolicy.
Microsoft’s documented Teams example uses -RecordTypes MicrosoftTeams -RetentionDuration TenYears -Priority 100. These settings define the workload, duration and precedence; the relevant users still need qualifying licensing.
Use Get-UnifiedAuditLogRetentionPolicy to review the configured policies. Document approved changes to scope, duration and priority so another administrator can reconstruct why a particular policy applies.
Portal configuration and PowerShell configuration affect the same retention controls. Using a script doesn’t bypass licensing or make a policy retroactive.
Verify coverage without assuming a search proves retention
A saved policy confirms configuration, not complete coverage. Review Microsoft 365 audit retention against the accounts, workloads and activities required for an investigation.
Use a short operational review:
- Confirm auditing is enabled and identify the supported events required for each workload.
- Record the generating user’s qualifying licence and every policy matching that user’s activity.
- After policy creation, generate a supported activity, then use the Audit search tool in the Microsoft Purview portal or
Search-UnifiedAuditLogto locate it. - Retain the search scope, event details, policy configuration and review date as configuration evidence.
Finding a fresh event shows that the activity was captured and is available now. It doesn’t prove the record will remain available for 10 years. That also depends on licensing, policy scope and priority.
Audit availability varies by workload, so searches aren’t real-time monitoring. A missing result may require investigation of the activity, filters and ingestion timing.
Include audit licensing in the Microsoft 365 leaver checklist before changing subscription assignments. Offboarding decisions should account for evidence requirements as well as mailbox access and file ownership.
Separate external archiving from Purview retention
Collect continuously before records become unavailable
The Office 365 Management Activity API allows organisations to collect audit records into external storage, Log Analytics or a security information and event management (SIEM) system such as Microsoft Sentinel. The external copy can be retained beyond 180 days.
The API exposes a limited recent collection window, normally 7 days. A long Purview retention window doesn’t provide an unlimited API backfill window. Monitor collection failures and recover missed batches promptly.
Microsoft’s auditing solutions overview describes a baseline of 2,000 API requests per minute per organisation. E5, A5 and G5 organisations receive approximately twice the bandwidth of non-E5 organisations, subject to dynamic throttling.
Define how archived evidence will be retrieved
An archive needs controlled access, documented retention, collection monitoring and a tested retrieval process. Where records require protection against alteration or deletion, assess immutable storage controls separately.
A SIEM adds search, detection and investigation workflows, but introduces costs beyond storing a retained copy. Define the required coverage and response owner before choosing the platform.
Review Entra and Insider Risk evidence separately
Entra sign-in logs have different retention
Microsoft Entra ID audit and sign-in logs have separate retention rules from the Microsoft 365 Unified Audit Log. Microsoft Entra data retention is 7 days with Entra ID Free and 30 days with P1 or P2.
A 1-year Purview audit entitlement does not extend every Entra authentication record. Our guidance on Microsoft 365 sign-in logs explains how authentication evidence differs from subsequent workload activity.
Azure Monitor diagnostic settings can export selected Entra log categories to Log Analytics. Analytics-table retention can reach 730 days, or 2 years; longer archival arrangements use different tiers. These are separately configured Log Analytics retention settings, not an extension of the Entra portal’s history.
Insider Risk alerts and cases expire independently
Insider Risk Management has its own evidence lifecycle. Alerts in Needs review or Dismissed status are deleted 120 days after creation. Resolved cases and associated artefacts are deleted 120 days after case resolution.
These Insider Risk Management limits are not replaced by a long-term audit policy. Preserve required investigation material through an approved process before the relevant deletion period expires.
Retention supports later investigation. It does not establish continuous monitoring or assign responsibility for responding to suspicious activity.
Frequently Asked Questions
Does an E5 subscription give every user one-year audit retention?
No. Retention depends on the licence of the user who generated the activity, along with the record type and any matching policy.
Which custom audit retention policy applies when several match?
The matching policy with the lowest numerical priority applies, and custom policies take precedence over the default policy. The longest retention period doesn’t automatically win.
Can a new policy extend retention for older audit records?
No. Audit retention policies aren’t retroactive, so a policy can’t extend records generated before it was created. Assign the required licences and create the policy before the activity needs longer retention.
Does one-year Purview audit retention also cover Entra sign-in logs?
No. Entra sign-in logs have separate retention rules from the Microsoft 365 Unified Audit Log. Exporting selected Entra logs to Log Analytics requires separate configuration.
Does finding an event in Audit search prove it will be retained for years?
No. A search result shows that the event was captured and is available at the time of the search. Longer retention also depends on licensing, policy scope and priority.
Make retention an accountable control
A defensible retention arrangement identifies the generating user, qualifying licence, record type, winning policy and any separate archive. The tenant’s subscription name is not enough.
Document those decisions and review collection alongside configuration. Evidence that expires before an investigation begins cannot be recovered by creating a longer policy afterwards.
Speak to our team about reviewing Microsoft 365 audit coverage, licensing and retention as part of our business IT security services.
