Audit Log Retention

Settings → Audit Log Retention controls how long audit-log entries are kept for your tenant. Set the retention window to match your compliance and record-keeping needs; older entries are pruned automatically.

Why it matters

Audit logs are your record of who did what. Keeping them forever bloats the log and can conflict with data-minimization policies; pruning too aggressively can leave you unable to investigate an incident or satisfy an auditor. This page lets you strike that balance — and keep noisy, low-value events for less time than sensitive ones.

What it shows

• Default retention (days) — the fallback window applied to any category you don't override.

• Per-category retention — separate windows for each class of event:

  • Authentication — sign-ins, sign-outs, impersonation (default 30 days).

  • Security — permission, policy, and API-key changes (default 365 days).

  • Admin & Configuration — settings, users, profiles, integrations (default 365 days).

  • Data Access — reads, downloads, exports, views (default 30 days).

  • Data Changes — creates, updates, deletes, business activity (default 90 days).

  • System — background jobs and platform events (default 90 days).

  • Other — anything uncategorized (default 90 days).

Windows can be set from 1 day up to 3650 days (10 years).

How to use it

• Lengthen Security and Admin retention to meet audit requirements; shorten noisy Authentication and Data Access categories to control log size.

• A category you leave untouched falls back to that category's platform default — not to your tenant default.

Gotchas

• Pruning is a hard delete run by a periodic background sweep — once entries age out they cannot be recovered, so set windows deliberately.

• Even a tenant that never opens this page gets bounded retention via the defaults above.

• Each sweep records its own entry in the audit trail, so the log notes that it was pruned.

Related

• Audit Trail & Logs — what the log records.