How to configure security monitoring and alerting for user management

Question

I am trying to create the following alerts:

User added	Triggered when a new user has been added.
User removed	Triggered when a any user has been removed.
User privilege changes	Triggered by any configuration change of any user.

I already tried to do this via the Audit Logs within the Identity section but the retention time is only 1 month there:

So my question is:

1. can I somehow increase the retention time?
2. can I somehow create a Monitor for these events and use this as a workaround for the 1 month retention time?

Answer 1

@Manuel Log storage within Microsoft Entra varies by report type and license type.

You can retain the audit and sign-in activity data for longer than the default retention period using Azure Monitor. For more information, see Integrate Microsoft Entra logs with Azure Monitor logs.