{
  "id": "CB-M365-AUDIT-003",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-003",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-003.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-003.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUDIT-003",
    "title": "Retain Microsoft 365 audit logs long enough for investigations",
    "finding": {
      "title": "Audit logs are deleted before an intrusion is usually discovered",
      "description": "Intrusions are often found months after they start; with only the default retention, the logs that show the initial access are gone when the investigation begins."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "audit",
      "logging",
      "retention",
      "purview",
      "siem",
      "incident-response"
    ],
    "description": "Microsoft 365 audit records (unified audit log and Microsoft Entra sign-in and audit logs) are:\n\n- searchable for at least **{{ audit_search_days }}** days, natively or in the SIEM;\n- kept and retrievable for at least **{{ audit_retention_days }}** days, in the SIEM or an\n  archive fed by CB-M365-AUDIT-002;\n- kept natively in Microsoft Purview Audit for at least **{{ audit_native_retention_days }}**\n  days, using an audit log retention policy (Audit Premium) when this exceeds the 180-day\n  default of Audit Standard.\n\nDurations are aligned with the legal and regulatory obligations that apply to the organization.\n",
    "rationale": "The median time to detect an intrusion is counted in weeks to months. Investigators need the\nfirst sign-ins, mailbox rules and consent grants of the attacker, which are often older than the\nnative retention. Keeping a copy in the SIEM also protects the records from a tenant\nadministrator. Native long retention (hardened) keeps the full detail of Microsoft events, such\nas mailbox access, available in Purview without depending on the SIEM.\n",
    "impact": "SIEM storage grows with retention. Native retention above 180 days needs Audit Premium (E5 or E5\nCompliance) for the users concerned; records of other users stay at 180 days. Microsoft Entra\nkeeps sign-in and audit logs natively for 30 days only with P1 or P2, so the SIEM copy is the\nonly source beyond that.\n",
    "parameters": [
      {
        "name": "audit_search_days",
        "type": "integer",
        "description": "Minimum number of days during which audit records can be searched directly.",
        "unit": "days",
        "default": 90,
        "minimum": 30
      },
      {
        "name": "audit_retention_days",
        "type": "integer",
        "description": "Minimum number of days during which audit records are kept and retrievable, in the SIEM or an archive.",
        "unit": "days",
        "default": 365,
        "minimum": 180
      },
      {
        "name": "audit_native_retention_days",
        "type": "integer",
        "description": "Minimum native retention in Microsoft Purview Audit for audit records of all users.",
        "unit": "days",
        "default": 180,
        "minimum": 180,
        "profile_defaults": {
          "hardened": 365
        }
      }
    ],
    "audit": {
      "manual": "1. Ask the SOC for the retention settings of the Microsoft 365 and Microsoft Entra tables in the\n   SIEM (interactive retention and archive) and check them against {{ audit_search_days }} and\n   {{ audit_retention_days }} days. Run a query on the oldest expected date to confirm the data\n   is there.\n2. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a member\n   of a role group with View-Only Audit Logs, browse to **Solutions** > **Audit** > **Audit\n   retention policies**.\n3. If {{ audit_native_retention_days }} is more than 180, check that a policy with the highest\n   priority among custom ones covers all users and all record types (or the record types the\n   organization lists) with a duration of at least {{ audit_native_retention_days }} days.\n4. Alternative in Security & Compliance PowerShell: `Get-UnifiedAuditLogRetentionPolicy |\n   Sort-Object Priority | Format-List Name,Priority,RecordTypes,UserIds,RetentionDuration`\n   (the built-in Audit Premium default policy is not listed).\n5. Check that no custom policy sets a duration shorter than {{ audit_native_retention_days }}\n   days for a record type, since custom policies override the default.\n6. Fail if any of the three durations is not met.\n"
    },
    "remediation": {
      "manual": "1. Set the retention of the Microsoft 365 and Microsoft Entra tables in the SIEM (for example\n   Log Analytics interactive retention and long-term retention) to meet\n   {{ audit_search_days }} and {{ audit_retention_days }} days.\n2. For native retention above 180 days, sign in to the Microsoft Purview portal with the\n   Organization Configuration role, browse to **Solutions** > **Audit** > **Create audit\n   retention policy**, leave **Users** and **Record type** empty to cover everything, choose a\n   duration of at least {{ audit_native_retention_days }} days and a priority, and save.\n3. Alternative in Security & Compliance PowerShell:\n   `New-UnifiedAuditLogRetentionPolicy -Name \"All activities - 1 year\" -RetentionDuration OneYear -Priority 100`\n   (adjust `-RetentionDuration` to the parameter).\n4. Make sure the users concerned hold an Audit Premium licence.\n",
      "rollback": "Delete the audit retention policy or lower the SIEM retention. Records already past the new\nretention are then purged.\n"
    },
    "references": [
      {
        "title": "Manage audit log retention policies",
        "url": "https://learn.microsoft.com/purview/audit-log-retention-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Microsoft Entra data retention",
        "url": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-reports-data-retention",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "New-UnifiedAuditLogRetentionPolicy",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/new-unifiedauditlogretentionpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Recommandations de sécurité pour l'architecture d'un système de journalisation",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/anssi-guide-recommandations_securite_architecture_systeme_journalisation.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.5.2v1",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.DEFENDER.6.3v1",
        "relation": "related",
        "note": "The US OMB M-21-31 durations are replaced by parameters set from the obligations that apply to the organization."
      },
      {
        "framework": "anssi-logging",
        "framework_version": "1.0",
        "id": "R25",
        "relation": "partial",
        "note": "Durations are parameters to align with the applicable regulation."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-11",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUDIT-001",
        "type": "requires"
      },
      {
        "id": "CB-M365-AUDIT-002",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-004",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-012",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}