I have been wondering about this one. Are you able to restore the logs/events, If someone changes the retention settings from 365 days to 30 days in the Log Analytics workspace? If you are able to restore these logs, how far back can you retrieve these logs?
Are there any automated processes which can cause a retention period to change?
Is there a way to alert on the retention settings being changed in Log Analytics? I have been testing in my personal environment, but it doesn't seem to be creating a Azure Activity Log for this action.
1. Please contact support for the best advise 2. Assuming you are logging "Administrative" events into the AzureActivity table (please check your diagnostic setting), then this example will get your last change