How can i increase the retention period of audit logs which configured in LogAnalyticsworkspace.

Question

How can i increase the retention period of audit logs which configured in LogAnalyticsworkspace.

Answer 1

Hi Riju Kumar,

Thanks for reaching out to Microsoft Q&A.

A Log Analytics workspace retains data in two states:

• Interactive retention: In this state, data is available for monitoring, troubleshooting, and near-real-time analytics.
• Long-term retention: In this low-cost state, data isn't available for table plan features, but can be accessed through search jobs.

How retention modifications work

When you shorten a table's total retention, Azure Monitor Logs waits 30 days before removing the data, so you can revert the change and avoid data loss if you made an error in configuration.

When you increase total retention, the new retention period applies to all data that was already ingested into the table and wasn't yet removed.

When you change the long-term retention settings of a table with existing data, the change takes effect immediately.

Permissions required

Action	Permissions required
Configure default interactive retention for Analytics tables in a Log Analytics workspace	Microsoft.OperationalInsights/workspaces/write and microsoft.operationalinsights/workspaces/tables/write permissions to the Log Analytics workspace, as provided by the Log Analytics Contributor built-in role, for example
Configure default interactive retention for Analytics tables in a Log Analytics workspace	Microsoft.OperationalInsights/workspaces/write and microsoft.operationalinsights/workspaces/tables/write permissions to the Log Analytics workspace, as provided by the Log Analytics Contributor built-in role, for example
Get retention setting by table for a Log Analytics workspace	Microsoft.OperationalInsights/workspaces/tables/read permissions to the Log Analytics workspace, as provided by the Log Analytics Reader built-in role, for example

You can change the default interactive period of Analytics tables to up to two years by modifying the workspace-level data retention setting. Basic and Auxiliary tables have a fixed interactive retention period of 30 days.

Please follow detailed steps in this guide ; https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-configure?tabs=portal-3%2Cportal-1%2Cportal-2

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.