Most organizations prefer retaining audit logs for years to support compliance investigations, respond to regulatory and legal obligations. How to Keep an Audit Log for More than 365 Days? Still, it works in a few tenants (luckily, mine is one of them!). We are not sure whether it’s a Microsoft feature or a bug. To check the long-term audit log capability, run the below cmdlet with a Date that is older than 90 days. So, you can check your tenant can retrieve the audit log for 365 days. Microsoft has not released any official announcement regarding long-term audit log availability for all the Microsoft 365 license types. In the below screenshot, I have retrieved July 2020 audit data, which is 365 days old data. Recently, when I play with the Search-UnifiedAuditLog cmdlet, it retrieved the last 365 days of audit data without any Microsoft 365 advanced auditing license. Is it possible to keep an audit log for more than 90 days without E5 license? Yes. Most admins want to keep an audit log for more than 90 days without E5/A5/G5 license or any additional add-ons to meet forensic, internal, and compliance investigations. By default, advanced auditing retains all Azure Active Directory, Exchange, SharePoint, and OneDrive audit records for one year. To retrieve an audit log for more than 90 days, you need to adopt Advanced auditing, which requires E5/A5/G5 subscriptions.

In the Basic audit, audit records are retained and searchable for the last 90 days. Basic auditing is enabled by default for most Microsoft 365 organizations. Microsoft 365 unified auditing helps to track activities performed in the different Microsoft 365 services by both users and admins.

Azure ad audit logs