Jun 13 2021 06:54 AM - edited Jun 13 2021 07:20 AM
I have been wondering about this one. Are you able to restore the logs/events, If someone changes the retention settings from 365 days to 30 days in the Log Analytics workspace? If you are able to restore these logs, how far back can you retrieve these logs?
Are there any automated processes which can cause a retention period to change?
Is there a way to alert on the retention settings being changed in Log Analytics? I have been testing in my personal environment, but it doesn't seem to be creating a Azure Activity Log for this action.
Jun 14 2021 05:34 AM