20.3 Configure Audit Retention Policies

Configure Audit Retention Policies

Quick Answer: Audit log retention policies are an Audit (Premium) feature. A default, unmodifiable policy keeps Microsoft Entra ID, Exchange, OneDrive, and SharePoint records for one year for Premium-licensed users. Everything else defaults to 180 days unless you create a custom policy. You can create up to 50 custom policies, ranked by priority 1 (highest) through 10000. Ten-year retention needs the 10-Year Audit Log Retention add-on and is not retroactive.

These policies retain audit records, not user content. They are not retention labels, not eDiscovery holds, and not Activity explorer's 30-day window. If the exam stem is about keeping messages or files, you are in Data Lifecycle Management or eDiscovery. If the stem is about keeping who accessed what, you are here.

Why custom policies exist

Audit (Standard) keeps records for 180 days. Many investigations, regulators, and insider-risk reviews need a longer trail for mailbox access, sharing, and directory changes. Premium's default policy covers the four high-volume workloads for one year. Custom policies cover other record types (Teams, DLP, Power BI, and the rest of the catalog), target high-risk users, or shorten retention when a workload must not keep logs for a full year.

Lifetime is stamped when the record enters the auditing pipeline. Changing a license or policy updates expiration for records ingested after the change. It does not rewrite already committed items. A 10-year policy created today does not resurrect logs that already aged out, and Microsoft states that 10-year retention is not retroactive.

Default Premium policy

Microsoft's retention-policy article (updated 2026-06-19) describes a default policy that:

• Applies to records whose Workload value is AzureActiveDirectory, Exchange, OneDrive, or SharePoint.
• Retains those records for one year.
• Cannot be modified.
• Applies only to activity performed by users with an Office 365 or Microsoft 365 E5 license, Microsoft Purview Suite (formerly Microsoft 365 E5 Compliance), or an E5 eDiscovery and Audit add-on license.
• Leaves non-E5 users and guest users on 180 days even for those workloads.

The Purview dashboard does not list this default policy. Get-UnifiedAuditLogRetentionPolicy does not return it either. If you open Audit retention policies and the list is empty, the default policy can still be in effect.

All other activities default to 180 days unless a custom policy matches them.

License gates for duration

To keep a user's audit log longer than 180 days (and up to 1 year), that user must have an eligible Premium license. To keep logs for 10 years, assign the 10-Year Audit Log Retention add-on and create a matching policy.

Published duration options when you create a policy:

If the acting user lacks the license for the duration you picked, Microsoft retains the record using the highest-priority policy that still matches that user and record type — often the license default (180 days or 1 year). Do not assume the UI duration you selected is what an unlicensed mailbox actually receives.

Audit records generated by non-user entities (service principals, system events, application activities) stay at a fixed one year. Custom policies do not apply to those records. Microsoft does not publish a way to keep service-principal audit records for 10 years inside Purview Audit.

Create a custom policy in the portal

You need the Organization Configuration role on Roles & scopes.

1. Sign in to the Purview portal and open the Audit solution.
2. Select Create audit retention policy.
3. Policy name: unique in the organization; you cannot rename it later.
4. Description: optional, but useful for record type, users, and duration.
5. Users: one or more users, or leave blank to apply to all users.
6. Record type: one type, multiple types, or blank for all types. Selecting one record type unlocks Activities so you can target specific operations. Selecting multiple record types applies to all activities of those types — you cannot pick individual operations.
7. Duration: one of the published options in the table above.
8. Priority: a number from 1 to 10000. Lower value = higher priority. Priority 5 beats priority 10. Every custom policy beats the default policy, even at priority 10000.
9. Save. The policy appears on the Audit retention policies dashboard.

That last rule is the exam trap. A custom Exchange policy of 6 months shortens Exchange mailbox audit retention below the default one year for the scoped users. Custom policies are overrides, not only extensions.

Your organization can have up to 50 audit log retention policies.

The dashboard lists custom policies. Sort by Priority to see evaluation order. You can edit most UI-created policies from the flyout. Policies created with New-UnifiedAuditLogRetentionPolicy for record types or activities the UI does not expose can only be viewed or deleted in the portal; edit them with Set-UnifiedAuditLogRetentionPolicy in Security & Compliance PowerShell. A banner on the flyout tells you when PowerShell is required. Deletion can take up to 30 minutes to take effect.

PowerShell

Connect to Security & Compliance PowerShell, then create policies the UI cannot express.

This example keeps all Microsoft Teams activities for 10 years at priority 100:

New-UnifiedAuditLogRetentionPolicy -Name "Microsoft Teams Audit Policy" -Description "One year retention policy for all Microsoft Teams activities" -RecordTypes MicrosoftTeams -RetentionDuration TenYears -Priority 100

This example keeps UserLoggedIn for one admin for six months at a higher priority (25):

New-UnifiedAuditLogRetentionPolicy -Name "SixMonth retention for admin logons" -RecordTypes AzureActiveDirectoryStsLogon -Operations UserLoggedIn -UserIds admin@contoso.onmicrosoft.com -RetentionDuration SixMonths -Priority 25

View policies with Get-UnifiedAuditLogRetentionPolicy (sort by Priority). The cmdlet does not return the default policy. Edit with Set-UnifiedAuditLogRetentionPolicy. Remove with Remove-UnifiedAuditLogRetentionPolicy (allow up to 30 minutes).

A practical design pattern

1. Confirm Premium licenses on the users whose records you must keep beyond 180 days.
2. Leave the default 1-year policy in place for Entra, Exchange, OneDrive, and SharePoint unless you have a documented reason to shorten it.
3. Add high-priority (low number) custom policies for high-risk users or high-value record types such as Teams or DLP.
4. If a regulation requires 10 years, buy the add-on, assign it, then create the 10-year policy before you need the evidence.
5. Export to a SIEM if you need retention beyond what Purview will store, or for non-user records custom policies cannot cover.

Exam traps

• Creating a 10-year policy without the add-on does not keep logs for 10 years.
• Guests and E3 users do not inherit the default 1-year policy.
• Priority 1 outranks priority 100; custom always outranks default.
• Audit retention is not a content hold: deleting a mailbox still requires eDiscovery or litigation hold if you need the messages themselves.
• Organization Configuration, not Audit Reader, is the role that creates these policies.

Official resources

• Manage audit log retention policies — default policy, 50-policy cap, durations, priority, PowerShell (updated 2026-06-19)
• Learn about auditing solutions in Microsoft Purview — Premium retention and non-user record limits