Data Retention for Azure ATP

%3CLINGO-SUB%20id%3D%22lingo-sub-1386776%22%20slang%3D%22en-US%22%3EData%20Retention%20for%20Azure%20ATP%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1386776%22%20slang%3D%22en-US%22%3E%3CP%3EI%20see%20lots%20of%20references%20to%20the%20type%20of%20data%2C%20password%20hashes%20and%20GDPR%20when%20I%20look%20for%20data%20retention%20but%20nothing%20specific%20to%20how%20many%20days%20Azure%20ATP%20will%20store%20data%20for%3F%20I%20found%20the%2090-day%20reference%20to%20Audit%20logs%20but%20nothing%20about%20personal%20data%20reported%20by%20the%20sensors.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMicrosoft%20Defender%20provides%20the%20option%20when%20creating%20the%20instance%20with%20a%20max%20of%20180%20days.%20Looking%20for%20something%20similar%20for%20Azure%20ATP.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20help%20much%20appreciated.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1407111%22%20slang%3D%22en-US%22%3ERe%3A%20Data%20Retention%20for%20Azure%20ATP%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1407111%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F225911%22%20target%3D%22_blank%22%3E%40Razmi%20Patel%3C%2FA%3E%26nbsp%3BI%20have%20alerts%20still%20appearing%20in%20my%20Azure%20ATP%20Portal%20from%202017.%20So%20it%20is%20much%20more%20than%20180%20days!%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22old.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F193440iD07DC90D26044455%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22old.jpg%22%20alt%3D%22old.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1407644%22%20slang%3D%22en-US%22%3ERe%3A%20Data%20Retention%20for%20Azure%20ATP%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1407644%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F5941%22%20target%3D%22_blank%22%3E%40Joe%20Stocker%3C%2FA%3E%26nbsp%3B%20%26nbsp%3Bthank%20you.%20I%20also%20found%20this...%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3E%22After%20a%20user%20is%20deleted%20from%20the%20organization's%20Active%20Directory%2C%20Azure%20ATP%20automatically%20deletes%20the%20user%20profile%20and%20any%20related%20network%20activity%20within%20a%20year.%22%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure-advanced-threat-protection%2Fatp-privacy-compliance%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure-advanced-threat-protection%2Fatp-privacy-compliance%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

I see lots of references to the type of data, password hashes and GDPR when I look for data retention but nothing specific to how many days Azure ATP will store data for? I found the 90-day reference to Audit logs but nothing about personal data reported by the sensors.

 

Microsoft Defender provides the option when creating the instance with a max of 180 days. Looking for something similar for Azure ATP.

 

Any help much appreciated.

2 Replies
Highlighted

@Razmi Patel I have alerts still appearing in my Azure ATP Portal from 2017. So it is much more than 180 days! 

old.jpg

Highlighted

@Joe Stocker   thank you. I also found this...

 

"After a user is deleted from the organization's Active Directory, Azure ATP automatically deletes the user profile and any related network activity within a year."

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-privacy-compliance