---
title: "How long are audit logs maintained (30 / 90 / 1 year)?"
url: https://insuranceposture.com/questions/network-and-logging/long-audit-logs-maintained
category: "Network, logging and monitoring"
canonical_key: q_aud_002
evidence_state: partial
updated: 2026-08-24
---

# How long are audit logs maintained (30 / 90 / 1 year)?

URL: https://insuranceposture.com/questions/network-and-logging/long-audit-logs-maintained
Section: Network, logging and monitoring
Evidence state: Partly verifiable from your tenant

Retention determines whether an investigation can establish when the intrusion began. If the window is shorter than the dwell time, the answer is that nobody knows.

## What the carrier is actually asking

The carrier is asking for a retention period, usually offering thirty days, ninety days, or a year. It is asking about the period for which logs are actually available, not the period stated in a policy.

## Why it is underwritten

Intrusions are frequently discovered months after they began. If logs cover thirty days, the investigation cannot determine the initial access vector or the scope of data accessed, which forces the most conservative notification position and increases the loss. Carriers have paid for that outcome often enough to ask directly.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

Retention settings are directly readable in the cloud, and they are frequently at defaults that nobody chose.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Azure | Log Analytics workspace retention and archive settings | Retention set deliberately, with archive tiers for the longer tail where cost matters |
| Azure | Activity log diagnostic setting destination retention | Beyond the ninety-day portal default, since the portal window cannot be extended |
| Entra ID | Sign-in and audit log export destination retention | Exported and retained, since portal retention is measured in weeks |
| Microsoft 365 | Audit log retention policy | Retention configured per record type, since the default varies by licence and is often shorter than assumed |
| Network | Firewall and flow log retention | Flow logs retained long enough to reconstruct network activity. Attested for on-premises |

**Different sources, different windows**

Most estates have a mix: endpoint telemetry for six months, sign-in logs for thirty days, cloud activity for ninety, network flows for a week. The investigative window is the shortest one covering the source you need, not the longest one you can quote.

## What a defensible yes requires

- Retention is stated per source, with the shortest one acknowledged.
- Security-relevant sources are retained for at least a year where cost allows.
- Retention matches what the incident response plan assumes.
- Archive tiers are used to make longer retention affordable rather than abandoning it.
- Any regulatory retention requirement is met separately and explicitly.

## How this answer goes wrong

The answer is a year, based on the endpoint tooling, while identity sign-in logs are at their portal default of thirty days. Identity logs are the ones an investigation needs first, and they are the shortest window in the estate.

## If this answer turns out to be wrong

Remote access exposure and log retention are what a forensic report describes first, which makes them the answers most often revisited after a loss. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Is 90 days enough?

It is the common minimum and it is often shorter than dwell time. A year for identity and control plane logs is a materially stronger position.

### Is retention expensive?

Hot retention is; archive tiers are much cheaper and remain searchable with a delay. Cost is rarely a real barrier to a year of security logs.

### What about regulatory requirements?

Some regimes set their own minimums that exceed what security investigation needs. Meet both and state them separately.

### What should we retain longest?

Identity, privileged activity, and cloud control plane. They answer the largest number of investigative questions per gigabyte.

## Related questions

- [Does the Applicant employ SIEM, log centralization, and audit logging across firewalls + IDS?](https://insuranceposture.com/questions/network-and-logging/applicant-employ-siem-log-centralization-audit-logging-across-firewalls)
- [Are administrator privileged access activities audited?](https://insuranceposture.com/questions/access-control/administrator-privileged-access-activities-audited)
- [Are backups tested for malware-free integrity prior to restoration?](https://insuranceposture.com/questions/backup-and-recovery/backups-tested-malware-free-integrity-prior-restoration)
- [Does local logging happen per-host?](https://insuranceposture.com/questions/network-and-logging/local-logging-happen-per-host)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.