About M365 backup

Question

There is recent new feature of M365 that can back up ODB,SPO,EXO
Its a pay as you go option but can we back up the audit logs of those services ?
If not then Can we store logs ?
For how long can we store logs?
and how muck backup can be possible?

Answer 1

Hi @Kuronuma,

Microsoft 365 Backup offers backup and recovery of OneDrive, SharePoint, and Exchange Online data for large volumes of data within the Microsoft 365 security boundary. However, it does not provide a way to back up audit logs of those services.

Microsoft 365 enforces logging requirements centrally through the policies set by the Microsoft 365 Security Team. Log data is uploaded to a proprietary security monitoring solution for near real-time (NRT) analysis, checking logs for potential security events and performance indicators. Logs are also uploaded to an internal, big data computing service (Azure Data Lake) for long-term storage.

Most audit log data stored in Azure Data Lake are kept for at least one year to support investigations of security incidents and to meet regulatory retention requirements. Service teams may select alternative retention periods of 90 days or longer for specific types of log data to support the needs of their applications. Microsoft 365 log retention and backup policies ensure log data is readily available for incident investigations, compliance reporting, and any other business requirements.

Reference: Overview of Microsoft 365 Backup (Preview).

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Microsoft 365's new backup feature supports OneDrive, SharePoint, and Exchange Online, offering a pay-as-you-go model. However, it's important to note that this feature doesn't extend to backing up audit logs for these services. For storing logs, Microsoft 365 uses a centralized policy for log retention set by the Microsoft 365 Security Team. Logs undergo near real-time analysis for security events and are also stored long-term in Azure Data Lake. The retention period for most audit log data in Azure Data Lake is at least one year, aimed at supporting security investigations and meeting regulatory requirements. Some log data might have a minimum retention of 90 days or more, depending on the service team's needs.