How long does Microsoft Entra ID retain sign-in and audit logs?

Microsoft Entra ID retains sign-in and audit logs for different periods depending on the log type and licensing, so organisations should not rely on the portal as a long-term record. Export logs to a security tool or storage with retention that meets investigation and compliance needs. Review retention settings regularly and confirm they cover the incidents you need to investigate.

What “retention” means in Entra ID

microsoft entra id does not give you one fixed retention period for every log. Sign-in logs and audit logs are retained differently, and what you can keep or query also depends on licensing and how the tenant is configured. The practical takeaway is that the portal is a short-to-medium term investigation source, not a compliance archive.

That distinction matters because teams often assume the tenant itself is the system of record. It usually is not. If you need evidence for incident response, HR investigations, legal hold, or audit sampling, you should plan to move logs out of the portal and into a platform that can retain them on your terms.

For a broader approach to collection, forwarding, and retention policy design, the Log Management and Retention Guide covers the storage tiers, integrity, and lifecycle decisions that determine whether logs remain usable after the portal window closes.

How to confirm you are not losing investigation evidence

Start by checking which log types you actually rely on in Entra ID, then compare those needs to your tenant’s exported retention path. Sign-in logs answer authentication and access questions; audit logs answer change and administration questions. If either stream disappears before your investigation window closes, you lose the ability to reconstruct who did what, when, and from where.

Export should be treated as an operational requirement, not an optional enhancement. Forward the logs into a SIEM, security data lake, or immutable storage tier where retention can be set independently of the portal. Then verify that the destination preserves searchability, timestamps, and enough context to support correlation across identity, endpoint, and cloud activity.

The Cloud Logging and Audit Trail Guide is useful here because it ties retention to tamper resistance, forwarding, and audit trail fidelity rather than to a single product screen.

For Entra-specific hardening and adjacent identity controls, the Active Directory and Entra ID Hardening Guide helps connect logging retention to the larger identity control plane, where access changes and administrative actions must be observable.

What to do when the built-in window is not enough

If the portal retention period is shorter than your business, regulatory, or forensic requirement, do not wait for a future incident to solve it. Build the export path first, then confirm that log ingestion is continuous and that retention is long enough to cover the longest plausible investigation window you expect to face.

When patching, change control, or reconfiguration must wait, retention becomes even more important because earlier log evidence may be the only way to determine whether an identity compromise or privilege misuse predated the visible alert. That is especially true for tenants where administrators, app registrations, or consent events can materially change the attack surface.

If you need a practical identity reference point for this sort of control design, the Microsoft 365 Security Guide covers Entra sign-in controls, PIM, and audit logs in the wider Microsoft 365 security model.

For teams managing privileged access explicitly, the Privileged Identity Management (PIM) Guide is relevant because privileged role activations and approvals are exactly the kind of events you want retained long enough to support review and rollback.

Risk and Threat Considerations

Short retention creates a blind spot when you need to prove whether a sign-in failure, suspicious token use, or administrative change was a false alarm or the start of a real compromise. If logs roll off before the case is opened, investigators may be forced to infer rather than verify, which weakens containment and post-incident decisions.

Failure mechanism: The environment depends on portal-native retention for evidence, but the relevant events age out before they can be exported, correlated, or legally preserved.

Impact: Teams lose forensic continuity, compliance evidence, and the ability to reconstruct identity activity across the full incident timeline.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AU-11 — Audit Record Retention	Retention length is the core issue for Entra sign-in and audit evidence.
Recommendation — Set log retention periods to preserve audit evidence for investigations and compliance.
CIS Controls v8	CIS-8 — Audit Log Management	The question is about retaining and preserving logs for later review.
Recommendation — Centralise and retain audit logs long enough to support investigation and compliance.
NIST CSF 2.0	PR.DS-01 — Data-at-rest is protected	Exported logs need durable storage that preserves their confidentiality and integrity.
Recommendation — Store exported logs in protected repositories with controlled access and durable retention.
ISO/IEC 27001:2022	A.8.15 — Logging	The subject concerns operational logging and how long those records are kept.
Recommendation — Define logging retention and handling rules in the ISMS and verify they are implemented.

Practitioner Guidance

What to verify: Confirm the retention period for each log type you actually use, not just the headline Entra ID setting. Then test whether your export pipeline preserves enough detail for casework, including timestamps, actor identity, resource, result, and correlation identifiers.

What to prioritise: Treat export and retention review as a control check, not a storage task. The first question is whether the logs survive long enough to answer the questions you will ask during an incident, an audit, or a regulatory review.

Practitioner takeaway: The portal is a visibility layer, not a durable evidence store, so the real control is whether your external retention design outlives the investigation window.