Anyone who has had to work out "who did what, and when?" in a Microsoft 365 tenant months after the event knows that the Microsoft 365 audit retention period quietly sets the deadline for legal and forensic requests. Many people assume the audit log keeps everything forever. They usually find out otherwise when they urgently need a record that has already been deleted. That's why you should know how long audit records are actually kept, what the standard tier covers, and how to extend retention when compliance requirements are stricter.

Audit (Standard) keeps 180 days and Audit (Premium) keeps one year

Every Microsoft 365 tenant with Exchange Online licensing gets Audit (Standard) by default, and it retains key activity data for 180 days. For routine troubleshooting that is often enough. For forensic investigations that go further back, or for strict compliance requirements, it isn't. With Microsoft Purview Audit (Premium), which comes with E5, Microsoft 365 E5 Compliance, or as a standalone Audit (Premium) SKU, the default audit retention rises to one year. Premium also covers far more activity (including events like MailItemsAccessed, which I describe in my post on MailItemsAccessed and mailbox forensics), gives you finer retention controls, and lets you keep certain records even longer.

Audit log retention policies fine-tune retention in the Purview portal

With Audit (Premium) you can create audit log retention policies that extend or shorten audit log retention per user or record type. The settings live in the Microsoft Purview portal → Solutions → Audit → Policies. You might, for example, keep records for executives or high-risk activities longer, while everything else stays on the default period. If you add the separately licensed ten-year add-on, policies can retain certain record types for up to a decade. Microsoft lists all the options and details under Audit log retention policies. Very few of my customers actually use these policies. Usually they either don't know they exist or don't have the right license.

flowchart TD
  AuditStandard["Audit (Standard): 180 days"] --> PurviewPremium["Purview Audit (Premium): 1 year"]
  PurviewPremium --> AuditPolicies["Audit log retention policies"]
  AuditPolicies --> TenYearsAddon["10 year add-on"]
  AuditPolicies --> GranularRetention["Per user/record type"]
  PurviewPremium --> MoreEvents["More activity types"]

Figure: How audit retention extends from Standard to Premium and on to granular policies.

A quick check confirms whether audit logging is enabled

In older tenants, or after complicated migrations, the unified audit log is sometimes not switched on at all. You can check this in Exchange Online PowerShell (role: Compliance Administrator or higher) with the following command:

Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled

"True" means auditing works as expected. "False" means it is off, and nothing gets logged until you enable it. I run into this fairly often in tenants that were provisioned by script or that went through cross-tenant mail migrations.

Tip from the field: After large migrations or bulk license assignments, get into the habit of confirming that audit logging is enabled for all users. Discovering a gap in the logs during an incident is too late.

Exporting to Sentinel or Log Analytics keeps audit data longer

When you have to keep audit records longer than Microsoft's built-in retention allows, whether for compliance, analytics or long-running investigations, there are two main routes: export to Microsoft Sentinel or to a Log Analytics workspace. Both need extra setup and licensing (Sentinel, Log Analytics capacity). Under Purview portal → Solutions → Audit → Export you configure forwarding, and copies of the audit events are then stored for as long as your business or legal requirements dictate. You also get advanced KQL queries, alerting and automation on top. Security operations teams like this setup a lot and often depend on it for incident investigations.

Purview audit search and PowerShell cover everyday searching

For everyday searches, the main tool is the Purview portal → Solutions → Audit → Search, where you filter by date range, user, activity and other criteria. There's no KQL support here, but you can export the results directly. If you prefer PowerShell, the Search-UnifiedAuditLog cmdlet (in Exchange Online PowerShell, with the appropriate roles) is a flexible alternative. For special cases such as auditing Copilot usage, see my detailed post on Copilot retention, audit and what happens to your prompts, which goes into Copilot audit log retention and search.

Microsoft's documentation on Audit search gives a good overview of all the search options.

Audit retention deserves attention before you need it

I don't treat Microsoft 365 audit retention as a compliance checkbox. It matters in practice for incident response and legal defense. If your organization could face investigations that run longer than a few months, relying on the default retention is a gamble. Make sure auditing is enabled, use audit log retention policies if you have Premium, and give serious thought to exporting to Sentinel or Log Analytics for long-term needs. A complete audit trail at the moment you need it is one of the most useful things mature Microsoft 365 governance gives you, so set it up properly before a crisis forces the issue.