Microsoft Purview Audit (Standard) is on by default and keeps audit records for 180 days. Audit (Premium) keeps Entra, Exchange, OneDrive and SharePoint records for one year by default and supports longer custom retention. If you may need older evidence, export to your own storage before the window closes.
What is on by default
Microsoft states Audit (Standard) is enabled by default for organizations with the appropriate subscription. You still need to assign permissions to search the log. It captures thousands of user and admin operations across many Microsoft services.
You can search in the Purview portal, through the Audit Search Graph API, with the Search-UnifiedAuditLog cmdlet, or retrieve records through the Office 365 Management Activity API.
Retention numbers
- Standard: 180 days. Records generated before October 17, 2023 were retained for 90 days under the older default.
- Premium: Entra, Exchange, OneDrive and SharePoint records are kept for one year by default. Other activities are kept 180 days unless you create a retention policy.
- Up to 10 years is possible for users with a separate add on license, and the policy is not retroactive.
Records from non user entities such as service principals are retained for a fixed one year and custom policies do not apply to them.
What Premium adds
Premium provides audit log retention policies, longer retention, intelligent insights and higher bandwidth for the Management Activity API. Intelligent insights include things like the sensitivity label of mail items accessed and what a user searched for in Exchange Online and SharePoint Online, which helps scope a compromise.
Why this matters for investigations
Most companies discover a mailbox or file compromise well after it started. If the first suspicious event is 200 days old and you have Standard retention, the record is gone. Check retention against your likely detection delay and your contractual or regulatory needs.
What to do
- Confirm which audit tier each user has.
- Decide how long you need records for incident response and audit requests.
- If 180 days is short, either license Premium for the people who matter most, or export on a schedule.
- Use the Management Activity API to send records to a store or SIEM you control. Microsoft notes this approach lets organizations keep data longer than the default and import it into a SIEM.
- Test a search for an event from last month so you know the permissions and process work.
- Write down who can search and who reviews alerts.
Evidence for audits
Auditors ask for logs showing admin changes and access. Know where those come from and for how long they exist. The demo below shows how controls map across frameworks, which helps explain why one log source answers several questions.
Try it yourself
Click through it at your own pace, or open it full screen. Look for how one piece of evidence can map to more than one framework control.
Quick check
Is audit logging on by default?
Microsoft states Audit (Standard) is enabled by default for organizations with the appropriate subscription.
How long does Standard keep records?
180 days.
Sources
Last reviewed: 19 October 2026.
