I was super excited to hear that the 10 year audit log was coming. We signed up and implemented it straight away.
HOWEVER... we then found out that the 10 year audit log will only apply to event generated after the point the policy is generated. Meaning there is no way to retain any audit logs for 12 months AFTER the policy is created. To say that this is a terrible way to apply a retention policy would be an understatement.
PLEASE PLEASE PLEASE allow us to apply retention policy to existing events in the current audit log and not force us to wait 12 months for the policy to take effect.
