Architecture
What to log, and for how long
Retention decisions made on cost end up made against you during an investigation. The sources worth keeping, and the periods that actually matter.
Microsoft
Retention is decided by finance and paid for by the incident
Log retention is almost always set at the point of budget approval, by someone comparing storage cost against a number with no obvious business value. Then an incident happens, the investigation needs to establish when access first occurred, and the logs start ninety days ago while the intrusion started in month five.
Median dwell time for some intrusion types comfortably exceeds ninety days. Ninety-day retention is a decision to be unable to answer the most important question.
| Suggested minimum | |
|---|---|
| Entra ID sign-in logs | 12 months |
| Entra ID audit logs | 12 months |
| Unified audit log (Purview) | 12 months, longer if regulated |
| Defender for Endpoint timeline | 6 months minimum |
| Mail flow and message trace | 90 days, longer for investigations |
| Firewall and proxy | Shortest. Highest volume, lowest yield |
Guidance, not a legal position. Regulated sectors have specific obligations that override any of this.
The cheap way to keep more for longer
Not everything needs to be queryable in seconds. Data kept for investigation rather than live detection can sit in a lower-cost tier and still be searchable when needed, at a fraction of analytics-tier cost.
That split is the mechanism that makes twelve-month identity retention affordable. Organisations that treat retention as a single setting either pay too much or keep too little, and usually the second.
The verdict
Twelve months on identity, tiered storage for the rest
Sign-in and audit logs are comparatively small, they answer the questions that matter first in an investigation, and tiering makes the volume affordable.
Do not keep everything for years by default. Storage is not free, and holding personal data longer than you can justify creates a different problem under data protection law.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.