What this check looks at
Works out how long audit records are kept from the tenant’s licences: one year for users with Microsoft Purview Audit (Premium), for example Microsoft 365 E5, and 180 days for everyone else.
How long the unified audit log keeps records depends on licences. With Audit (Standard), included in every business plan, records are kept for 180 days. With Audit (Premium), part of Microsoft 365 E5, E5 Compliance and the E5 eDiscovery and Audit add-on, the default policy keeps Exchange, SharePoint, OneDrive and Microsoft Entra records for licensed users for one year, and audit retention policies can keep chosen record types longer (up to ten years with a further add-on).
The check works this out from licences: it counts enabled member accounts that hold any licence, and how many of them have a licence including the Audit (Premium) service plan (M365_ADVANCED_AUDITING). It passes when at least 95% do, and otherwise warns with the number of users whose records are kept for 180 days only. It cannot see audit logs exported to a SIEM, so if you keep them elsewhere, record that against the finding.
Compromises are often found months after they start: a forwarding rule nobody noticed, a supplier chasing an invoice that was paid to someone else. If the attacker got in more than 180 days before anyone looked, the start of the story (how they got in and what they took first) has already been deleted.
Why it matters
Breaches are often found months after they start. PCI DSS asks for 12 months of audit history and many investigations need longer; with 180 days, the start of the story may already be gone.
A typical case: in March a firm finds a forwarding rule that has been sending the managing director’s mail to an outside address since the previous August. The audit log only goes back to September. The creation of the rule, the sign-in that created it and anything read in the first weeks are gone, so the firm cannot show the ICO which data the attacker saw and has to notify on the worst-case assumption.
Twelve months of history turns that into a bounded incident with evidence. It also answers the question cyber insurers and incident responders ask first: how far back can you see?
PCI DSS 10.5.1 asks for twelve months of audit log history with three months immediately available, and CISA SCuBA MS.DEFENDER.6.3v1 asks for audit logs to be kept for the required period (this check covers it partly). It supports ISO 27001 A.8.15 and the NCSC Cyber Assessment Framework’s C1.b on securing logs.
How to fix it
Where: Microsoft Purview portal → Audit → Audit retention policies
Before you start
- Decide where history will live: Audit (Premium) licences for key users, or an export to a SIEM or storage account.
Step by step
- Decide how long, and for whom. Twelve months covers PCI DSS and what most insurers expect; regulated firms may need longer. Decide whether it is needed for everyone or at least for the people most likely to be targeted: directors, finance, HR and administrators.
- Choose the route. Either buy Audit (Premium) licences for those users (Microsoft 365 E5, E5 Compliance, or the E5 eDiscovery and Audit add-on), or export the audit log to Microsoft Sentinel or another log store with twelve months’ retention. A business already paying for Sentinel or a managed SIEM usually takes the second route.
- If licensing, assign the licences by group. Buy the licences in the Microsoft 365 admin centre (Billing > Purchase services). In the Microsoft Entra admin centre, open the group of users to cover (Entra ID > Groups > the group > Licences > Assignments), assign the licence, and make sure the Microsoft 365 Advanced Auditing service plan is left on.
- If licensing, add an audit retention policy. In the Microsoft Purview portal, go to Solutions > Audit, open Audit retention policies (under Policies) and create a policy: name it, choose the users or record types to cover (for example Microsoft Teams, which the default policy does not), set the duration to one year or longer and save.
- If exporting, connect Microsoft Sentinel. In the Azure portal, create a Log Analytics workspace (UK South) and add Microsoft Sentinel to it. In Sentinel, go to Content hub, install the Microsoft 365 solution, then under Data connectors open the Microsoft 365 connector, tick Exchange, SharePoint and Teams, and apply. Set the OfficeActivity table’s retention to 365 days (workspace > Tables > OfficeActivity > Manage table). Ingesting these logs is free in Sentinel; keeping them beyond 90 days is charged.
- Confirm the change. With licences, the users show the Audit (Premium) service plan, and the next assessment counts them as having a year of history; once time has passed, an audit search for an event older than 180 days returns results. With Sentinel, running OfficeActivity | take 10 in the workspace’s Logs returns recent events, and the table’s retention shows 365 days.
What users will notice
None.
How to confirm it worked
Search the audit log for an event older than 180 days (with Premium), or confirm the export is receiving data.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | C1.b Securing logs |
| NIS2 | Art. 21(2)(b) Incident handling |
| Microsoft Cloud Security Benchmark | LT-6 Configure log storage retention |
| Zero Trust | Visibility, automation and orchestration |
| SOC 2 | CC7.2 Monitoring system components for anomalies |
| PCI DSS 4.0.1 | 10.5.1 Audit log history is retained for at least 12 months |
| NIST SP 800-171 | 3.3.1 Create and retain system audit logs and records |
| CMMC Level 2 | AU.L2-3.3.1 System Auditing |
| ISO 27001:2022 | A.8.15 Logging |
| CISA SCuBA | MS.DEFENDER.6.3v1 Audit logs kept for the required period |
| CIS Controls v8.1 | 8.10 Retain audit logs (IG2) |
| NIST CSF 2.0 | PR.PS-04: Log records are generated and made available for continuous monitoring |
| NCSC 10 Steps | Logging and monitoring |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Audit log retention policies (Microsoft Learn)