O365/Azure AD Logs and Sentinel - what retention?


It's great to see data from O365/Azure AD ingested to Sentinel at no cost. 


Does that mean that O365/Azure AD data retained beyond 31 days will be billable?

3 Replies
Yes. Only one month retention is free. By the way, I believe it is O365 only, not AAD data, which is free. I will check. that.

Thanks - important to check on Azure AD.



I have confirmed and indeed only Office 365 logs are free.