# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-AUDIT-003
title: Retain Microsoft 365 audit logs long enough for investigations
finding:
  title: Audit logs are deleted before an intrusion is usually discovered
  description: Intrusions are often found months after they start; with only the default retention, the logs that show the initial access are gone when the investigation begins.
status: active
profiles: [baseline]
risk:
  severity: high
assessment: manual
tags: [audit, logging, retention, purview, siem, incident-response]

description: |
  Microsoft 365 audit records (unified audit log and Microsoft Entra sign-in and audit logs) are:

  - searchable for at least **{{ audit_search_days }}** days, natively or in the SIEM;
  - kept and retrievable for at least **{{ audit_retention_days }}** days, in the SIEM or an
    archive fed by CB-M365-AUDIT-002;
  - kept natively in Microsoft Purview Audit for at least **{{ audit_native_retention_days }}**
    days, using an audit log retention policy (Audit Premium) when this exceeds the 180-day
    default of Audit Standard.

  Durations are aligned with the legal and regulatory obligations that apply to the organization.
rationale: |
  The median time to detect an intrusion is counted in weeks to months. Investigators need the
  first sign-ins, mailbox rules and consent grants of the attacker, which are often older than the
  native retention. Keeping a copy in the SIEM also protects the records from a tenant
  administrator. Native long retention (hardened) keeps the full detail of Microsoft events, such
  as mailbox access, available in Purview without depending on the SIEM.
impact: |
  SIEM storage grows with retention. Native retention above 180 days needs Audit Premium (E5 or E5
  Compliance) for the users concerned; records of other users stay at 180 days. Microsoft Entra
  keeps sign-in and audit logs natively for 30 days only with P1 or P2, so the SIEM copy is the
  only source beyond that.

parameters:
  - name: audit_search_days
    type: integer
    description: Minimum number of days during which audit records can be searched directly.
    unit: days
    default: 90
    minimum: 30
  - name: audit_retention_days
    type: integer
    description: Minimum number of days during which audit records are kept and retrievable, in the SIEM or an archive.
    unit: days
    default: 365
    minimum: 180
  - name: audit_native_retention_days
    type: integer
    description: Minimum native retention in Microsoft Purview Audit for audit records of all users.
    unit: days
    default: 180
    minimum: 180
    profile_defaults:
      hardened: 365

audit:
  manual: |
    1. Ask the SOC for the retention settings of the Microsoft 365 and Microsoft Entra tables in the
       SIEM (interactive retention and archive) and check them against {{ audit_search_days }} and
       {{ audit_retention_days }} days. Run a query on the oldest expected date to confirm the data
       is there.
    2. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a member
       of a role group with View-Only Audit Logs, browse to **Solutions** > **Audit** > **Audit
       retention policies**.
    3. If {{ audit_native_retention_days }} is more than 180, check that a policy with the highest
       priority among custom ones covers all users and all record types (or the record types the
       organization lists) with a duration of at least {{ audit_native_retention_days }} days.
    4. Alternative in Security & Compliance PowerShell: `Get-UnifiedAuditLogRetentionPolicy |
       Sort-Object Priority | Format-List Name,Priority,RecordTypes,UserIds,RetentionDuration`
       (the built-in Audit Premium default policy is not listed).
    5. Check that no custom policy sets a duration shorter than {{ audit_native_retention_days }}
       days for a record type, since custom policies override the default.
    6. Fail if any of the three durations is not met.

remediation:
  manual: |
    1. Set the retention of the Microsoft 365 and Microsoft Entra tables in the SIEM (for example
       Log Analytics interactive retention and long-term retention) to meet
       {{ audit_search_days }} and {{ audit_retention_days }} days.
    2. For native retention above 180 days, sign in to the Microsoft Purview portal with the
       Organization Configuration role, browse to **Solutions** > **Audit** > **Create audit
       retention policy**, leave **Users** and **Record type** empty to cover everything, choose a
       duration of at least {{ audit_native_retention_days }} days and a priority, and save.
    3. Alternative in Security & Compliance PowerShell:
       `New-UnifiedAuditLogRetentionPolicy -Name "All activities - 1 year" -RetentionDuration OneYear -Priority 100`
       (adjust `-RetentionDuration` to the parameter).
    4. Make sure the users concerned hold an Audit Premium licence.
  rollback: |
    Delete the audit retention policy or lower the SIEM retention. Records already past the new
    retention are then purged.

references:
  - title: Manage audit log retention policies
    url: https://learn.microsoft.com/purview/audit-log-retention-policies
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Microsoft Entra data retention
    url: https://learn.microsoft.com/entra/identity/monitoring-health/reference-reports-data-retention
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: New-UnifiedAuditLogRetentionPolicy
    url: https://learn.microsoft.com/powershell/module/exchangepowershell/new-unifiedauditlogretentionpolicy
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Recommandations de sécurité pour l'architecture d'un système de journalisation
    url: https://messervices.cyber.gouv.fr/documents-guides/anssi-guide-recommandations_securite_architecture_systeme_journalisation.pdf
    publisher: ANSSI
    kind: guide
    accessed: 2026-10-24
mappings:
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.SECURITYSUITE.5.2v1
    relation: equivalent
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.DEFENDER.6.3v1
    relation: related
    note: The US OMB M-21-31 durations are replaced by parameters set from the obligations that apply to the organization.
  - framework: anssi-logging
    framework_version: "1.0"
    id: "R25"
    relation: partial
    note: Durations are parameters to align with the applicable regulation.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AU-11
    relation: related
related_controls:
  - id: CB-M365-AUDIT-001
    type: requires
  - id: CB-M365-AUDIT-002
    type: related
  - id: CB-M365-AUDIT-004
    type: related
  - id: CB-M365-AUDIT-012
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24