Microsoft Purview audit retention

4slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

solvingmicrosoft365.com

1 / 4

Microsoft Purview audit retention

How long Microsoft 365 retains audit logs by default, what Audit (Premium) adds, and how to think about retention.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/purview-audit-and-retention

Slide 1Download PNG

solvingmicrosoft365.com

2 / 4

How long does Microsoft 365 keep audit logs?

180 days for Audit (Standard), one year for users with Audit (Premium) — included in E5 and E5 Compliance — and up to ten years with the 10-Year Audit Log Retention add-on. Retention is set per record type and user thro…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/purview-audit-and-retention

Slide 2Download PNG

solvingmicrosoft365.com

3 / 4

Does audit retention apply retroactively?

No. Events are retained according to the licence and policies in place when they were logged. Buying Audit Premium today does not recover events that already expired under the 180-day rule.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/purview-audit-and-retention

Slide 3Download PNG

solvingmicrosoft365.com

4 / 4

What does Audit Premium add beyond retention?

Higher-value events such as MailItemsAccessed, Send, SearchQueryInitiated in Exchange and SharePoint, and higher API bandwidth for exporting audit data to a SIEM — the events investigators need to answer 'what did the a…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/purview-audit-and-retention

Slide 4Download PNG

Auto-generated from Microsoft Purview audit retention. This page is not indexed and isn't part of the guide itself.