Is Your Microsoft 365 Audit Log On, and How Long Is It Kept? A Retention Check by Licence

The short version: Microsoft 365 audit log retention is 180 days for Audit (Standard) and one year for Exchange, SharePoint, OneDrive and Entra records of users with an E5-level Audit (Premium) licence. Auditing is on by default for most enterprise tenants but not for Business Basic, Business Standard or Business Premium, where an administrator has to switch it on. Run one PowerShell command to see which case you are in, then compare the retention you have with the period you may need to look back.

Most tenants discover their audit log settings at the worst moment: after a suspicious sign-in or a mailbox rule that nobody created, when someone asks "what happened, and when?". If auditing was never turned on, there is nothing to search. If it was on but the retention was 180 days and the event was seven months ago, the evidence has expired.

This guide is a self-check you can do in about 30 minutes. It covers whether the Microsoft 365 unified audit log is switched on, how long records are kept for each licence type, the separate and much shorter Entra ID sign-in log, and what to change if the answer is not good enough. Retention figures were checked on Microsoft Learn on 5 November 2026; the pages cited are named in each section because Microsoft changes these numbers from time to time.

Is the Microsoft 365 audit log turned on in your tenant?

Not necessarily, and the answer depends on your licence. Microsoft states that audit logging is on by default for Microsoft 365 organisations, but also that auditing is *not* enabled by default for Small and Medium Business licences, including Microsoft 365 Business Basic, Business Standard and Business Premium. Tenants created on free trials of enterprise licences are in the same position. In those cases an administrator must turn it on.

That matters for small firms, because Business Premium is a common choice for small and mid-size companies. If yours is one of them, assume nothing until you have checked.

To verify, connect to Exchange Online PowerShell (not Security & Compliance PowerShell) and run:

Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

True means auditing is on. False means it is off. Microsoft warns that the same cmdlet in Security & Compliance PowerShell always returns False, even when auditing is on, so run it in the right session or you will chase a problem that does not exist.

If it returns False, turn it on with Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true, or from the Audit page in the Microsoft Purview portal by selecting the banner to start recording user and admin activity. Microsoft says it can take up to 60 minutes to take effect, and records may take several hours to become searchable. Nothing is recorded retrospectively, so every day it stays off is a day you cannot investigate later.

You need the *Audit Logs* role in Exchange Online to change the setting; by default the Compliance Management and Organization Management role groups have it.

How long does Microsoft 365 keep audit records?

Retention is set per record when it is written, and it follows the licence of the user who performed the action. Microsoft's Purview documentation gives the following picture.

• Audit (Standard): 180 days. Records generated on or after 17 October 2023 are kept for 180 days. Records generated before that date were kept for 90 days. This is the baseline for every user who does not hold an E5-level licence, and for guest users.
• Audit (Premium), default policy: one year for four workloads. Microsoft Entra, Exchange, OneDrive and SharePoint audit records are kept for one year. This default policy cannot be modified, and it applies to activity by users holding a Microsoft 365 E5 or Office 365 E5 licence, or a Microsoft Purview Suite or E5 eDiscovery and Audit add-on.
• Audit (Premium), everything else: 180 days by default. Teams and other workloads stay at 180 days unless you create a custom retention policy.
• Up to 10 years with an add-on. Each user whose records you want to keep for 10 years needs a 10-Year Audit Log Retention add-on licence on top of the E5-level licence. It is not retroactive: it cannot keep records created before the policy existed.
• Non-user activity: one year, fixed. Actions by service principals, system events and application activity are retained for a fixed one year that you cannot change.

One detail catches people out. Retention follows the *user who generated the record*, not the person searching. A tenant with a few E5 licences and many Business Premium users will have one year of history for some people and 180 days for the rest. Microsoft also notes that changing a licence changes the expiry of data from then on, but does not alter items already committed.

What does that look like by licence?

Use this as a working map, then confirm against your own assignments in the Microsoft 365 admin center.

Business Basic, Business Standard and Business Premium

Auditing is not on by default, so check it first. Once on, expect 180 days of Audit (Standard) records. There are no audit log retention policies available in this tier because those belong to Audit (Premium).

Microsoft 365 E3 and Office 365 E3

Audit (Standard) is on by default, with 180 days of retention. This is the case in which most mid-size tenants live, and 180 days is also the limit on searchable history if your insurer or an investigation asks about the last twelve months.

Microsoft 365 E5, Office 365 E5, or an E5 Compliance / Purview Suite / eDiscovery and Audit add-on

Audit (Premium) applies to the licensed users. Exchange, SharePoint, OneDrive and Entra records are kept for one year by default, other records for 180 days, and you can create custom retention policies to extend them. You can have up to 50 custom audit log retention policies, and you need the *Organization Configuration* role in the Purview portal to create them.

A custom policy overrides the default, in either direction. Microsoft's example: a policy for Exchange mailbox activity that is shorter than a year will shorten retention for those records, so review any existing policies before assuming you get a year.

Is the Entra ID sign-in log the same thing?

No, and this is the second place tenants get caught. Microsoft Entra audit and sign-in logs are separate from the Microsoft 365 unified audit log. Their retention is tied to the Entra ID edition, not to Purview Audit. Per Microsoft Learn (checked 5 November 2026):

• Entra ID Free: audit logs and sign-in logs for 7 days.
• Entra ID P1 and P2: audit logs and sign-in logs for 30 days.
• Risky sign-ins: 7 days on Free, 30 days on P1, 90 days on P2.
• Microsoft Graph activity logs: not retained unless you send them to storage or an analytics tool.

Business Premium includes Entra ID P1, so you get 30 days of sign-in history in Entra itself, which is short when the question is a suspicious sign-in discovered next month. Microsoft notes that organisations with E5-level licences can use Audit (Premium) to retain Entra audit logs beyond the default period, and that anyone can route Entra logs to an Azure storage account through Azure Monitor for longer retention.

For a suspected account compromise, the practical effect is simple. You may have 30 days of detailed sign-in data and 180 days or a year of audit activity. Know which is which before you need either.

How do you check what you actually have?

Work through these steps in order. Each takes a few minutes.

1. Confirm auditing is on. Run the Get-AdminAuditLogConfig command above in Exchange Online PowerShell. Record the result and the date.
2. Run a test search. In the Microsoft Purview portal, open Audit, choose a date range of the last seven days and search for your own sign-in or a file you opened. If nothing returns, auditing is off or not yet searchable.
3. Find the oldest record. Search the widest range the tool allows, narrow to one user, and note the earliest record. If the oldest record is about 180 days old for a user you expected to have a year, their licence or a custom policy is shortening it.
4. List custom retention policies. In Security & Compliance PowerShell, run Get-UnifiedAuditLogRetentionPolicy | Sort-Object -Property Priority -Descending | FL Priority,Name,RecordTypes,UserIds,RetentionDuration. Microsoft notes this cmdlet does not return the default policy, so an empty list is normal.
5. Map users to licences. Note which people hold E5-level licences. Privileged accounts such as administrators and executives are the ones whose history you would most want to keep for longer.
6. Check Entra edition and log export. In the Entra admin center, confirm whether you are on Free, P1 or P2, and whether sign-in and audit logs are being sent anywhere for longer storage.
7. Record who can search. Audit search needs permissions of its own. Make sure the people who would investigate can, and that nobody has turned the setting off. Microsoft notes that turning auditing off is itself recorded, and you can find it with Search-UnifiedAuditLog -Operations Set-AdminAuditLogConfig.

Keep the outputs. They show what your tenant was configured to do on the day you checked.

What should you change if retention is too short?

The right target depends on what you have to answer. As a rule of thumb, decide how far back you would need to look, and then work out the cheapest way to reach it.

• Turn auditing on first. Nothing can be recovered without it, and Microsoft's instructions for the plans where it is off are to turn it on from the Purview portal or with one PowerShell command.
• Export before it expires. The Office 365 Management Activity API lets you pull records into your own storage or a SIEM, and Microsoft describes it as the way to keep data longer than the default 180 days. For Entra logs, Azure Monitor can archive to a storage account.
• Extend only for the users who matter. A custom retention policy needs Audit (Premium) licensing for the users it covers. Often a short list of administrators, finance and executive accounts is enough, instead of licensing everyone.
• Use the 10-year add-on sparingly. It is per user, and only worth it if a regulatory, legal or contractual period requires it. Do not assume you need it.
• Review the policy list. Remove or correct a custom policy that quietly shortens a default.

Whether a longer period is *required* is a question for your insurer, auditor or legal adviser, not for this article. What this guide gives you is the fact base: what is on, what is kept and for how long.

How does this connect to a Microsoft 365 security audit?

Audit log status and retention is one of the checks a configuration audit makes, because it decides what evidence exists after an incident. It sits alongside mail forwarding, authentication and sharing settings in the findings. In a Brocent Microsoft 365 security audit it is read from configuration only: whether auditing is on and what retention applies, never the contents of mail or documents. See the sample report (English page) for how findings are presented, and the security audit checklist for the other areas reviewed.

It also matters for questionnaires. Questions such as "Do you log administrator activity and keep the logs for a set period?" are common in cyber-insurance forms. Your answers should come from the checks above, not from memory. See the Microsoft 365 evidence behind cyber-insurance questionnaires for how to collect it.

Frequently asked questions

Is the Microsoft 365 audit log enabled by default?

For most enterprise tenants, yes. Microsoft says it is not enabled by default for Business Basic, Business Standard and Business Premium, or for unmanaged tenants on free trials of enterprise licences. Run Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled in Exchange Online PowerShell to see your own status.

How long is the Microsoft 365 audit log kept?

180 days under Audit (Standard) for records created on or after 17 October 2023. With Audit (Premium) and an E5-level licence, Exchange, SharePoint, OneDrive and Entra records are kept for one year by default, and custom policies can extend that to 10 years with an add-on licence.

What is the difference between Purview Audit Standard and Premium?

Standard gives you search, export, API access and 180 days of retention. Premium adds one-year default retention for four workloads, custom retention policies, longer retention up to 10 years with an add-on, intelligent insights and higher API bandwidth. Premium includes everything in Standard.

Does Business Premium keep sign-in logs for a year?

No. Business Premium includes Entra ID P1, which keeps sign-in and audit logs for 30 days in Entra itself. Audit records in Purview are a separate store with 180 days for non-E5 users. To keep more, export the logs.

Can I recover audit records from before I turned auditing on?

No. Auditing is not retroactive. Records exist only from the time it was enabled, and changes to retention do not extend items already written.

Does a Brocent audit read my audit log contents?

The audit reads configuration through a read-only Microsoft Graph app, including whether auditing is on and how retention is set. It does not read mail or document content. The report is designed to be used as evidence for common cyber-insurance questionnaire and Cyber Essentials questions; it does not grant or guarantee certification.

Next steps

Run the three checks today: auditing status, the oldest record for an important user, and your Entra edition. Write down the result and the date. If you would like an independent review of this and the rest of the tenant, the Microsoft 365 Security Audit pricing page lists the fixed price for your headcount, from US$450 for 1–10 users, one-time and excluding tax, with the report delivered 5–7 business days after read-only access is granted.

If you want to talk through your results, contact us. For broader reading, see how much a Microsoft 365 security audit costs and the Microsoft 365 security checklist.