How long does Microsoft 365 keep audit logs?

Nobody searches for this on a quiet afternoon. The question turns up after something has already gone wrong. A supplier says they were paid into the wrong account, or a director thinks a leaver walked off with the client list. Sometimes it's an insurer asking exactly when somebody got into a mailbox. So somebody opens the audit log, and it either goes back far enough or it doesn't.

For the Microsoft 365 business plans most small firms are on, the short answer is 180 days. That's the unified audit log in Microsoft Purview. It isn't the whole answer, and two parts of the rest catch people out. Microsoft's own documentation says the audit log isn't switched on by default for Business Basic, Business Standard or Business Premium. And the sign-in log, usually the first thing anyone wants after a mailbox takeover, keeps seven days on most small-business plans and 30 on Business Premium.

How long each log lasts

Microsoft 365 doesn't have one log. It has several, kept by different services, and each runs on its own clock. Here's what Microsoft's documentation says for each, with Windows added because investigations end up there too.

Two rows matter more than the others. The audit log lines up almost exactly with what the NCSC recommends, which we'll come back to. The sign-in log doesn't come close.

First, check it's actually recording

This is the bit we'd do before reading any further. Microsoft's page on turning auditing on and off opens by saying audit logging is on by default for Microsoft 365 organisations. Then comes the note: auditing isn't enabled by default for small and medium business licences, including Business Basic, Business Standard and Business Premium. Microsoft's auditing overview sounds more relaxed about it. We'd trust the note that names your plan, and check.

Checking takes a minute. Sign in to the Microsoft Purview portal and open Audit. If auditing is off, a banner offers to start recording user and admin activity. In PowerShell, connect to Exchange Online and run Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled. True means it's recording. Run it in Exchange Online PowerShell specifically, because Microsoft warns that the same cmdlet in Security & Compliance PowerShell always reports False, even when auditing is on.

If it's off, switch it on today. Microsoft says it can take up to 60 minutes to take effect. It doesn't reach back, either. The audit search documentation says that if auditing was turned on within the last 180 days, a search can't start before the date it was turned on. Last month's incident left no trail if nobody had pressed the button.

Mailbox auditing is a separate switch, and Microsoft's mailbox auditing page says it's on by default in every organisation. It's the part that records inbox rules being changed and mail being deleted. Get-OrganizationConfig | Format-List AuditDisabled should come back False. While you're there, look for one more thing. An admin can exempt named accounts from mailbox auditing altogether with Set-MailboxAuditBypassAssociation, and an exempt account is a gap that nobody ever remembers creating.

What 180 days of audit log can tell you

Quite a lot, once it's running. Microsoft describes the unified audit log as capturing thousands of user and admin operations across dozens of services. For a small business, the mailbox part is usually where it starts.

Take the supplier fraud in our business email compromise article. Somebody gets into a mailbox, reads invoices for a few weeks, then sets up a rule so that replies from the real supplier never reach the inbox. Mailbox auditing logs every change to an inbox rule by default, including changes made by delegates and admins rather than the owner. In a lot of investigations that entry is the clearest single line in the whole log, and it has a date and time on it.

The next question, from an insurer or a solicitor, is which emails they actually read. Microsoft's answer is an action called MailItemsAccessed. It covers every mail protocol, from Outlook and phones to the old IMAP and POP clients. Messages opened one at a time are logged by message ID, grouped into a single record for each two-minute window. When desktop Outlook syncs a whole folder, the log records the folder rather than each message, and Microsoft's guidance is blunt: assume every item in that folder was compromised. It also admits the limit. Mail downloaded to somebody's computer and read offline can't be audited at all.

Microsoft documents MailItemsAccessed as part of Audit (Standard) and on by default for users with E3 or E5 licences. It doesn't say the same about Business plans in so many words, so check a mailbox's audit settings rather than assume.

Searching has its own habits. You need the Audit Logs or View-Only Audit Logs role to search at all. Microsoft says records from the core services, Exchange and SharePoint among them, usually turn up 60 to 90 minutes after the event, and won't commit to a time. The search screen defaults to the last seven days, so widen it. And exports from Audit (Standard) stop at 50,000 rows. That sounds like plenty until you search a busy shared mailbox for a month.

The same log records file sharing too, which our piece on restricting external sharing covers.

The sign-in log runs out first

The audit log tells you what an account did. The sign-in log in Microsoft Entra ID records where each sign-in came from and whether it worked, and after a mailbox takeover it's usually the first thing anybody asks for. Did someone log in from another country three weeks ago? That's a sign-in question.

Microsoft's Entra data retention page has the numbers. On Entra ID Free, sign-ins and directory audit events are kept for seven days. On Entra ID P1 and P2, it's 30. According to Microsoft's Entra licensing page, Free comes with Microsoft 365 subscriptions and P1 is included in Business Premium. So Business Basic and Business Standard get a week. The same retention page also points out that the Entra logs are separate from the unified audit log and are retained differently.

Seven days is the number that hurts. A payment fraud found when the real supplier chases an unpaid invoice is almost never found within a week of the login that made it possible.

Upgrading doesn't rescue the evidence, either. Microsoft's own FAQ on that page asks whether you can see last month's data after buying a premium licence, and answers no. Retention changes aren't retroactive. If you're weighing Business Premium for this and other reasons, Standard against Premium covers what else P1 brings, and the honest time to decide is before you need it.

Keeping sign-ins beyond 30 days means sending them out of Entra. Through diagnostic settings, Entra can stream its logs to an Azure storage account or a Log Analytics workspace. Microsoft's setup guide lists what that needs: an Azure subscription with a Log Analytics workspace in it, and someone with at least the Security Administrator role. It's an Azure service with its own bill, separate from your Microsoft 365 licences.

The logs that aren't in Microsoft 365 at all

Not everything worth knowing happens in the cloud.

Every Windows computer keeps its own event logs, on the computer. Microsoft's Event Log policy reference says the Security log defaults to a maximum of 20 megabytes and the Application log to 1 megabyte, and that unless somebody has set a policy, new events overwrite old ones when a log fills up. How long 20 MB lasts depends on how busy the machine is. Nobody knows until they look, and by then the week you wanted may have gone. If the laptop was stolen or wiped, its logs went with it.

Email delivery is another. Exchange message trace, which shows what arrived and where it went, searches up to 90 days, but Microsoft says the client IP address is only available for 10. Then there's the router or firewall in the comms cupboard. If it's a basic router, its logs may not survive a reboot, which is one of the reasons the firewall article gives for buying a proper one.

The NCSC's introduction to logging calls logs spread across devices, reachable only by logging in to each one, bad practice. For Windows it suggests Windows Event Forwarding, which sends events from each machine to a central store.

What the NCSC says is long enough

The NCSC's 10 Steps guidance on logging and monitoring gives a figure. It can be months before incidents are detected, it says, so it recommends keeping your most important logs for at least six months. The older introduction to logging gives the same minimum and the reasoning behind it: the M-Trends 2018 report it cites put the average time to detect a cyber attack at 101 days, and sometimes much longer.

Put that next to the table. The unified audit log, at 180 days, just about meets it, provided somebody switched it on. Sign-ins at seven or 30 days don't. Neither does a Windows log measured in megabytes rather than months.

The same guidance makes two points that matter more than the number. Protect logs from tampering, because an attacker who gets far enough will try to remove the evidence. And make sure somebody notices when logs stop arriving. Both apply to Microsoft 365 directly. An account with enough admin rights can turn the audit log off with one PowerShell command. Microsoft does record that the setting changed, but that record sits in the same tenant the attacker is standing in. Microsoft also says that with auditing off, the feeds that other tools read from stop as well.

In fairness to the cloud, the NCSC doesn't say everything must be copied out. Its introduction says cloud email services may already hold their logs in an easy-to-search interface for a suitable length of time, and that for most common scenarios extracting them won't add enough to justify the cost. For the mailbox audit trail at 180 days, we agree. The case for a second copy rests on the sign-ins, the computers, the firewall and that one off switch.

Where a SIEM fits, and where it doesn't

A SIEM, short for security information and event management, is that second copy done properly. It collects logs from Microsoft 365, Entra, the computers and the firewall into one place, keeps them for a period you choose, lets you search all of them at once and raises alerts on patterns that need a human to look. For the Microsoft 365 part, Microsoft names the route itself. Its auditing overview says the Office 365 Management Activity API lets organisations keep audit data longer than the default 180 days and import it into a SIEM.

It has limits. A SIEM can't collect a log that was never written, so if the audit log was off in March, nothing will show you March. It doesn't replace the investigation: somebody still has to read what it found and decide what it means. And it isn't proportionate for everybody. The NCSC says there's no one-size-fits-all approach, and that for some organisations simply collecting logs in case of an incident is the right fit.

For a five-person office on Business Standard, with company laptops and nothing regulated, our honest advice is often smaller. Switch the audit log on and confirm mailbox auditing. Then decide whether Business Premium's 30 days of sign-ins is worth it for everything else it brings. A SIEM starts to pay for itself when you need sign-in history longer than a month, or when the evidence has to survive somebody getting admin rights to the tenant. It also helps when a client asks to see logs rather than hear about them.

Keeping everything forever isn't the answer either

Logs are about people. A sign-in record carries a name, an IP address, a rough location and a time, and a mailbox record says who opened what. That makes most of them personal data, and Article 5(1)(e) of the UK GDPR, the storage limitation principle, says personal data should be kept in a form that identifies people for no longer than the purpose needs.

So pick a period for each log, write down why, and stick to it. Six months for the important ones has the NCSC behind it. Ten years of everything probably has nothing behind it at all. We're not a law firm and we're not anybody's data protection officer, so where the right number depends on your contracts or your sector, that's a question for your solicitor or DPO. If an incident might be a reportable breach, our article on the 72-hour notification rule covers the deadline. The logs are how you work out what was affected in time to meet it. And if the worry is a leaver rather than an outsider, the offboarding checklist is the other half of that story.

What it costs with us

The checks above cost nothing. Switching on the audit log and confirming mailbox auditing is ten minutes' work for whoever holds the admin password, and you don't need us for it. If you'd rather somebody else looked, ask for the free IT health check.

SIEM and log retention sit in our Complete plan, at £108 per user per month, alongside 24/7 out-of-hours support, managed detection and response, compliance reporting and an annual disaster-recovery test. Our cybersecurity page describes it as an evidence trail for when you need one, whether that's for an investigation or an insurer. Professional, at £77, adds EDR, email security, phishing training and managed backup, but not the SIEM. Essential is £50. All three run on a monthly agreement with 30 days' notice, and the full breakdown is on the pricing page.

If you only want the Microsoft side sorted, that's ordinary tenant work. On a plan, anything outside scope is £86 an hour. Without one it's £126, or £167 out of hours with a two-hour minimum. Microsoft 365 licences, Business Premium included, are supplied at list price and we don't mark them up. All prices exclude VAT.

One request, whoever you buy log retention from, us included. Get the number of days in writing, and ask where the copy lives. If the answer is "in the same tenant", it isn't much of a second copy.