Retain Microsoft 365 audit logs long enough for investigations

Description

Microsoft 365 audit records (unified audit log and Microsoft Entra sign-in and audit logs) are:

• searchable for at least {{ audit_search_days }} days, natively or in the SIEM;
• kept and retrievable for at least {{ audit_retention_days }} days, in the SIEM or an archive fed by CB-M365-AUDIT-002;
• kept natively in Microsoft Purview Audit for at least {{ audit_native_retention_days }} days, using an audit log retention policy (Audit Premium) when this exceeds the 180-day default of Audit Standard.

Durations are aligned with the legal and regulatory obligations that apply to the organization.

Rationale

The median time to detect an intrusion is counted in weeks to months. Investigators need the first sign-ins, mailbox rules and consent grants of the attacker, which are often older than the native retention. Keeping a copy in the SIEM also protects the records from a tenant administrator. Native long retention (hardened) keeps the full detail of Microsoft events, such as mailbox access, available in Purview without depending on the SIEM.

Impact

SIEM storage grows with retention. Native retention above 180 days needs Audit Premium (E5 or E5 Compliance) for the users concerned; records of other users stay at 180 days. Microsoft Entra keeps sign-in and audit logs natively for 30 days only with P1 or P2, so the SIEM copy is the only source beyond that.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Ask the SOC for the retention settings of the Microsoft 365 and Microsoft Entra tables in the SIEM (interactive retention and archive) and check them against {{ audit_search_days }} and {{ audit_retention_days }} days. Run a query on the oldest expected date to confirm the data is there.
2. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a member of a role group with View-Only Audit Logs, browse to Solutions > Audit > Audit retention policies.
3. If {{ audit_native_retention_days }} is more than 180, check that a policy with the highest priority among custom ones covers all users and all record types (or the record types the organization lists) with a duration of at least {{ audit_native_retention_days }} days.
4. Alternative in Security & Compliance PowerShell: Get-UnifiedAuditLogRetentionPolicy | Sort-Object Priority | Format-List Name,Priority,RecordTypes,UserIds,RetentionDuration (the built-in Audit Premium default policy is not listed).
5. Check that no custom policy sets a duration shorter than {{ audit_native_retention_days }} days for a record type, since custom policies override the default.
6. Fail if any of the three durations is not met.

Remediation

1. Set the retention of the Microsoft 365 and Microsoft Entra tables in the SIEM (for example Log Analytics interactive retention and long-term retention) to meet {{ audit_search_days }} and {{ audit_retention_days }} days.
2. For native retention above 180 days, sign in to the Microsoft Purview portal with the Organization Configuration role, browse to Solutions > Audit > Create audit retention policy, leave Users and Record type empty to cover everything, choose a duration of at least {{ audit_native_retention_days }} days and a priority, and save.
3. Alternative in Security & Compliance PowerShell: New-UnifiedAuditLogRetentionPolicy -Name "All activities - 1 year" -RetentionDuration OneYear -Priority 100 (adjust -RetentionDuration to the parameter).
4. Make sure the users concerned hold an Audit Premium licence.

Rollback

Delete the audit retention policy or lower the SIEM retention. Records already past the new retention are then purged.

References

• Manage audit log retention policies Microsoft, vendor-doc, accessed 2026-10-24
• Microsoft Entra data retention Microsoft, vendor-doc, accessed 2026-10-24
• New-UnifiedAuditLogRetentionPolicy Microsoft, vendor-doc, accessed 2026-10-24
• Recommandations de sécurité pour l'architecture d'un système de journalisation ANSSI, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• requires CB-M365-AUDIT-001 Turn on the unified audit log
• related CB-M365-AUDIT-002 Forward Microsoft 365 security logs to the SIEM or SOC
• related CB-M365-AUDIT-004 Enable Audit Premium events for all users
• related CB-M365-AUDIT-012 Restrict who can read, disable or shorten Microsoft 365 audit logs

People and lifecycle