Forum Discussion
Audit license
I am wondering what happens to the audit log when a license is removed. So the user has been assigned with audit premium license, which allows a audit data retention to 1 year (according to the audit log retention policy and the treshhold defined by the license). A user leaves the organization, in which the license is returned to the pool. Is the audit data retained to the point that the user had a license, or is all data beyond the Audit standard threshold (180 days) deleted?
after re-reading the information about the audit log retention, i must conclude that either the default auditing policy prevails, or if you a custom retention policy, with a shorter retention span prevails. This as a custom audit retention policy overrules the default auditing retention policy.
What kind of confuses me is following sentence:
The default audit log retention policy only applies to audit records for activity performed by users who are assigned an Office 365 or Microsoft 365 E5 license or have a Microsoft 365 E5 Compliance or E5 eDiscovery and Audit add-on license. If you have non-E5 users or guest users in your organization, their corresponding audit records are retained for 180 days.Pondering the information get me more confused. So if i want to retain audit logs for more than 1 year, do i need to assign a 10-year auditing license to the owner of the audit policy, and assign this license to the subjects of the policy as well?
