Which Microsoft 365 Logs Should You Keep?

Keep the Microsoft 365 audit evidence needed to reconstruct user activity, administrator changes, and access to business information, alongside relevant identity and endpoint records. Verify collection, licensing, retention, and export permissions before an incident. A retention setting is not enough if the event was never recorded or nobody can retrieve it.

Microsoft Purview Audit provides a searchable record of user and administrator activities across Microsoft services. Its Standard and Premium offerings have different capabilities and retention conditions, making a tested evidence plan more useful than a blanket claim that “Microsoft keeps our logs” (Microsoft Purview Audit overview).

What are the key takeaways?

• Audit Standard generally retains current audit records for 180 days (Microsoft documentation).
• Premium’s default one-year retention applies to specified workloads and appropriately licensed users, not automatically every record in the tenant (Microsoft retention policies).
• Test a harmless activity from generation through search and export using the actual responder account.
• Define who preserves evidence, who authorizes access, and who pays for additional collection or storage.

Which questions should your evidence plan answer?

Start with the investigation questions, then map each one to an available record source and an accountable owner. We recommend planning around account access, administrative changes, data activity, and the actions responders take during containment.

For example, ask how you would investigate an unexpected mailbox rule, a new administrator, an unusual file-sharing action, or a disputed access change. Do not promise that one audit record answers all of those questions by itself. Identify the identity, application, and endpoint evidence you would correlate.

Microsoft’s overview describes auditing across Microsoft services, but also distinguishes premium activity properties and licensing requirements. That distinction matters when deciding whether your evidence plan relies on a record or field the tenant actually generates (Microsoft audit capabilities).

Write an evidence map with columns for the question, source, event or activity, eligible users, search owner, retention, and export destination. Keep examples sanitized. The aim is a repeatable retrieval process, not a growing collection of screenshots that nobody can interpret during an incident.

How long are Microsoft 365 audit records retained?

For Audit Standard records generated on or after October 17, 2023, Microsoft documents a default retention period of 180 days. Audit Premium provides one-year default retention for eligible Microsoft Entra ID, Exchange, OneDrive, and SharePoint audit records, subject to the relevant licensing conditions (Microsoft Audit overview) (Microsoft retention policy details).

Microsoft’s retention-policy documentation states that the one-year default depends on the user generating the record having a qualifying license, such as Microsoft 365 E5 or the specified add-on. Non-E5 and guest-user records are generally retained for 180 days under the described default policy (Microsoft licensing and retention rules).

Do not translate that into “our tenant has a year of everything.” Our recommendation is to test representative user categories and workloads, then record any custom policies or exceptions that apply. Ask the licensing owner to confirm the entitlement rather than inferring it from an administrator’s portal access.

Keep the business retention decision separate from the platform default. Legal, contractual, and investigation needs should inform what evidence you preserve and where. This article does not prescribe one universal retention period or imply that a product default satisfies every obligation.

How do you verify collection before an incident?

Generate a harmless, approved test activity and prove that an authorized responder can find and export its record. We recommend a controlled test in an appropriate account, with the expected event and time recorded before the search begins.

Microsoft explains that turning auditing off stops records from being available through the audit search and associated access paths, and enabling it does not mean records appear instantly. Check actual ingestion rather than assuming a toggle or subscription proves coverage (Microsoft auditing configuration guidance).

Use a checklist that can be repeated after licensing, configuration, or provider changes. Record whether the result was present, delayed, incomplete, or unavailable, and assign an owner for unresolved gaps.

1. Choose the question: identify a safe action that represents the investigation need, such as an approved administrative change.
2. Confirm the account: record the relevant user category, license, and workload so the result is not generalized to everyone.
3. Generate and locate the event: preserve the expected time and activity, then search through the intended responder workflow.
4. Export and inspect: verify that the exported artifact contains the fields needed for correlation and can be opened outside the portal.
5. Check the handoff: transfer the sanitized result through the approved evidence channel and confirm that the receiving team can use it.
6. Record limits: document delays, unavailable fields, retention assumptions, and the next validation date.

What should an outsourced monitoring provider prove?

Ask the provider to demonstrate retrieval using the service you are buying, not a separate demonstration tenant with different permissions or licensing. Require a clear statement of which records are collected continuously and which are retrieved only after a request.

Our recommended acceptance criteria include a named escalation contact, a supported export format, a documented authorization path, and a response expectation for urgent evidence requests. Clarify whether historical searches and incident investigation are included or separately scoped.

Distinguish “we receive alerts” from “we can reconstruct activity.” Ask for the underlying records available to the analyst and what remains in Microsoft rather than the provider’s platform. If an integration fails, require a defined owner for detection and restoration of collection.

Also decide how the customer obtains its investigation records when the service ends. A provider exit should not leave the organization unable to interpret its own evidence. Agree the process before there is a contract dispute or an urgent incident.

How should you preserve evidence during account compromise?

Preserve the relevant records through an approved process while the incident lead coordinates containment. Our recommendation is to document the search scope, time range, export method, and person collecting each artifact so subsequent reviewers understand what it represents.

Keep original exports separate from working notes and analysis. Restrict access to the people who need the evidence, and avoid circulating raw records through general chat channels. Record gaps explicitly rather than replacing missing facts with assumptions.

Do not delay necessary containment solely to make an evidence package tidy. Have the incident owner weigh operational urgency against preservation needs and record the decision. That is why the export and authorization process should be rehearsed before a real account compromise.

If a legal hold or regulatory requirement applies, involve the appropriate advisers. The operational checklist here is not a substitute for case-specific preservation instructions, and a log archive is not automatically an adequate legal hold.

How would our SOC test the plan?

Our U.S.-based security operations center (SOC) would use a hypothetical account-compromise scenario to test the handoff from alert to evidence. We would ask an authorized operator to locate the relevant activity, export it, and explain what additional identity or endpoint records are needed.

We would then test an account with different licensing and an unavailable primary contact. Those variations help identify assumptions that a single successful search would miss. This describes our proposed validation method, not a claim about a customer incident or a completed tenant audit.

Our Microsoft 365 and Azure security services can support the review. Pair this with non-human identity governance for service-account ownership and the managed SOC pricing guide for evidence and investigation scope.

What else should buyers know?

Does Audit Standard retain one year by default?

No. Microsoft documents 180-day default retention for Audit Standard records generated on or after October 17, 2023 (Microsoft Audit overview).

Does one E5 license extend retention for everyone?

No. The documented extended-retention conditions depend on the users generating the records and the relevant workloads, not merely one licensed account in the tenant (Microsoft retention requirements).

Can we rely only on the retention setting?

No. We recommend verifying generation, search, export, and the incident handoff. Retention does not demonstrate that the required event was collected or that a responder can retrieve it.

What should we test after changing providers?

Test representative activity through the actual collection and export paths, confirm permissions, and document which historical records remain available. Keep an owner for any migration-related visibility gaps.

Need help defining the next step?

Bring your licensing summary, logging map, and provider scope for an evidence-readiness review. Schedule a security review or Call 833-92-CYBER to discuss scope and ownership.