Home

O365/Azure AD Logs and Sentinel - what retention?

%3CLINGO-SUB%20id%3D%22lingo-sub-388099%22%20slang%3D%22en-US%22%3EO365%2FAzure%20AD%20Logs%20and%20Sentinel%20-%20what%20retention%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-388099%22%20slang%3D%22en-US%22%3E%3CP%3EIt's%20great%20to%20see%20data%20from%20O365%2FAzure%20AD%20ingested%20to%20Sentinel%20at%20no%20cost.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EDoes%20that%20mean%20that%20O365%2FAzure%20AD%20data%20retained%20beyond%2031%20days%20will%20be%20billable%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-389520%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20O365%2FAzure%20AD%20Logs%20and%20Sentinel%20-%20what%20retention%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-389520%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20confirmed%20and%20indeed%20only%20Office%20365%20logs%20are%20free.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-388720%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20O365%2FAzure%20AD%20Logs%20and%20Sentinel%20-%20what%20retention%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-388720%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20-%20important%20to%20check%20on%20Azure%20AD.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F293879%22%20target%3D%22_blank%22%3E%40Ofer_Shezaf%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-388540%22%20slang%3D%22en-US%22%3ERE%3A%20O365%2FAzure%20AD%20Logs%20and%20Sentinel%20-%20what%20retention%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-388540%22%20slang%3D%22en-US%22%3EYes.%20Only%20one%20month%20retention%20is%20free.%20By%20the%20way%2C%20I%20believe%20it%20is%20O365%20only%2C%20not%20AAD%20data%2C%20which%20is%20free.%20I%20will%20check.%20that.%3C%2FLINGO-BODY%3E
Karen McGregor
Microsoft

It's great to see data from O365/Azure AD ingested to Sentinel at no cost. 

 

Does that mean that O365/Azure AD data retained beyond 31 days will be billable?

3 Replies
Yes. Only one month retention is free. By the way, I believe it is O365 only, not AAD data, which is free. I will check. that.

Thanks - important to check on Azure AD.

 

@Ofer_Shezaf 

I have confirmed and indeed only Office 365 logs are free.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies