M365AUDIT-002: Audit log retention policy
- Plataforma
- Entra ID / M365
- Categoría
- Unified Audit & Logging
- Severidad
- High
- Pilar de Zero Trust
- Visibility & Analytics (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
By default, Microsoft 365 audit log records are retained for 180 days (or 90 days for standard licenses), which may be insufficient for detecting long-running attacks or meeting regulatory compliance requirements. Advanced persistent threats may operate within an environment for months before detection, and without adequate log retention, the forensic evidence needed for investigation may have already been purged. Extending audit log retention ensures that historical activity data is available when needed.
Valor recomendado
Audit log retention set to at least 365 days; priority activity types retained for longer periods; logs exported to external SIEM for long-term storage
Remediación
Configure audit log retention policies in the Microsoft Purview compliance portal to retain all audit log records for at least 365 days, extending retention for high-priority record types such as MailItemsAccessed, FileAccessed, and UserLoggedIn. For organizations with Microsoft 365 E5 or equivalent licensing, configure 10-year retention policies for critical audit record types to support long-term forensic investigations. Implement log export to an external SIEM or log analytics platform such as Microsoft Sentinel for long-term storage and advanced correlation beyond the native retention period.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.DEFENDER.6.3v1
- NIST SP 800-53
- AU-11
- CIS M365 Benchmark
- 3.1.2