From the course: Microsoft Information Security Administrator Associate (SC-401) Cert Prep by Microsoft Press

Unlock this course with a free trial

Join today to access over 25,400 courses taught by industry experts.

Configure audit retention policies

Configure audit retention policies - Microsoft 365 Tutorial

From the course: Microsoft Information Security Administrator Associate (SC-401) Cert Prep by Microsoft Press

Start my 1-month free trial Buy for my team

Configure audit retention policies

“

By default, with premium audit enabled, Purview keeps audit log entries for one year for major services like Exchange, SharePoint, Entra, and Teams. However, your organization might have compliance requirements to retain logs for longer periods, sometimes up to seven or 10 years, especially in regulated industries. Purview allows you to define audit retention policies to override the default retention. You can extend retention to 3, 5, 7, or even 10 years for specific types of audit records. Note that going beyond one year and up to 10, requires the 10-year audit log retention add-on license. You can narrow the scope of a policy by record type. For example, you can create a policy just for Exchange admin activities or just for SharePoint file activities. So this means you could keep certain logs longer, like admin actions, without having to keep everything that long. You can also filter by activity if needed, so only retain, for example, mailbox expert or mail items access events…

Contents