When you need to know whether someone downloaded or shared your files, Microsoft 365’s activity records are often the best evidence available. But they don’t last forever, and many businesses find out too late that the records they needed have already expired.
The short answer
- Microsoft Purview Audit (Standard): audit records are kept for 180 days.
- Microsoft Purview Audit (Premium): records for Microsoft Entra ID, Exchange, OneDrive and SharePoint are kept for one year by default. Other activities are kept for 180 days unless you set a longer retention policy.
- Longer retention: with Audit (Premium), custom retention policies can keep records for up to one year, or up to 10 years for users with Microsoft’s 10-year audit log retention add-on.
- Microsoft Entra ID sign-in and audit logs (in the Entra admin centre) are kept for just 7 days on the free tier and 30 days with Entra ID P1 or P2.
Why this matters
If a staff member left three months ago and you’re only now noticing clients moving to a competitor, the window may already be closing. Longer retention policies are not retroactive: switching one on today won’t bring back records that have already expired.
What to do now
- If you suspect something has happened: have the relevant audit records exported and preserved straight away, before they roll off.
- Check your licences: find out whether your organisation has Audit (Standard) or Audit (Premium), and what that means for retention.
- Consider longer retention for key staff, or exporting logs to separate storage, as part of normal security housekeeping.
- Don’t forget other systems: Google Workspace, Xero, laptops and phones keep their own records, each with their own limits.
Retention periods and licensing change over time, so check Microsoft’s current documentation for your plan. If you’d like help preserving or reviewing your logs, call us on 0467 697 148.
Sources
- Microsoft Learn: Learn about auditing solutions in Microsoft Purview
- Microsoft Learn: Microsoft Entra data retention
Retention figures checked against Microsoft documentation on 29 October 2026. Microsoft may change these at any time.