Audit log: retention durations, roles, and search limits
Verdict: Default retention is one year and cannot be edited. Custom policies override it for shorter windows. 10-year retention needs a per-user add-on on E5. View-Only Audit Logs searches without config rights. Search jobs cap at 180 days.
| Criterion | Default policy | Custom policy | 10-Year add-on | View-Only Audit Logs role |
|---|---|---|---|---|
| What it controls | Retention duration for Entra, Exchange, OneDrive, SharePoint records | Retention duration for a scoped set of users or locations | Retention ceiling per user, on top of Audit (Premium) E5 | Permission to run audit log searches |
| Default duration | One year | Set by the admin, e.g. 6 months | 10 years | N/A, a role assignment |
| Can it be edited or scoped | No, fixed and cannot be modified | Yes, takes priority over the default policy | Applies per assigned user, not tenant-wide | Grants search only, no config rights |
| Choose when | No action needed, this is the baseline | A group needs shorter or longer retention than one year | Specific users must keep records a full decade | An analyst must search but not change retention settings |
Rules
- 10-year retention requires a per-user 10-Year Audit Log Retention add-on license in addition to Audit (Premium) E5; a second E5 does not extend retention.
- The default audit log retention policy covers Entra, Exchange, OneDrive and SharePoint for one year and cannot be modified.
- To retain records for less than a year, create a custom audit log retention policy scoped to the users or locations; custom policies take priority over the default.
- Assign View-Only Audit Logs for least-privilege search access; assign Organization Configuration only to create or modify retention policies.
- A single audit search job is capped at a 180-day date range; longer windows must be split across multiple searches.
Traps
- A second Microsoft 365 E5 license does not raise the retention ceiling - only the 10-Year Audit Log Retention add-on does.
- Removing E5 to shorten retention drops users to the 180-day default and breaks Premium features; it is not a controlled way to set a 6-month window.
- The default retention policy cannot be edited to a shorter or longer duration - a custom policy is required instead.
- The 180-day search cap is a tool limit, not related to the 10-Year add-on, which governs retention duration, not search window length.