How long does Azure AD store the Audit and Sign-ins events data?

Activity reports
ReportAzure AD FreeAzure AD BasicAzure AD Premium P1Azure AD Premium P2
Audit logs7 days7 days30 days30 days
Sign-insN/AN/A30 days30 days
Azure MFA usage30 days30 days30 days30 days
You can retain the audit and sign-in activity data for longer than the default retention period outlined above by routing it to an Azure storage account using Azure Monitor. For more information, see Archive Azure AD logs to an Azure storage account.
Security signals
ReportAzure AD FreeAzure AD BasicAzure AD Premium P1Azure AD Premium P2
Users at risk7 days7 days30 days90 days
Risky sign-ins7 days7 days30 days90 days

Comments