Kurt Shintaku's Blog

Your organization’s unified audit log captures, records, and retains thousands of user and admin operations performed in dozens of Microsoft services and solutions.

Security ops, IT admins, insider risk teams, and compliance and legal investigators in your organization can search audit records for these events. This capability provides visibility into the activities performed across your organization.

For Microsoft 365 GCC customers, there are 2 audit logging retention durations available, depending on the license subscribed to:

• Microsoft 365 G3 (GCC) licensed customers are entitled to 180 days of audit logging by virtue of their entitlement to Purview Audit Standard.
• Microsoft 365 G5 (GCC) licensed customers are entitled to 1 year of audit logging by virtue of their entitlements to Purview Audit Premium.

Reference:

Audit Standard
180-day audit log retention. When a user or admin performs an audited activity, the system generates an audit record and stores it in the audit log for your organization. In Audit (Standard), the system retains records for 180 days, which means you can search for activities that occurred within the past six months.

Audit Premium
…Up to 1-year audit log retention…

“Default audit log retention policy in Audit (Premium)”:
“The default retention period for Audit (Standard) changed from 90 days to 180 days. Audit (Standard) logs generated before October 17, 2023 are retained for 90 days. Audit (Standard) logs generated on or after October 17, 2023 follow the new default retention of 180 days.”

“Before you create an audit log retention policy“:
“To retain an audit log for longer than 180 days (and up to 1 year), the user who generates the audit log (by performing an audited activity) must have an Office 365 E5 or Microsoft 365 E5 license or a Microsoft Purview Suite (formerly known as Microsoft 365 E5 Compliance) or E5 eDiscovery and Audit add-on license.”

Audit Log Retention beyond 1 year
For government customers licensed for Microsoft 365 GCC that require audit log retention for longer than 1 year, customers are required to have, for the user that requires auditing for longer than 1 year:

• Microsoft 365 G5 license
• Advanced Audit 10 Year GCC license

Reference:

“Before you create an audit log retention policy“:
“To retain audit logs for 10 years, the user who generates the audit log must also have a 10-year audit log retention add-on license in addition to an E5 license.“

Licensing SKU
The licensing SKU for government customers to request from their LAR for the “10 year Purview Audit GCC license” is:

• 8LF-00001 Advanced Audit 10 Year GCC Sub Add-on (Licensed per user, per month)