Confirmation of Azure Log Retention and Archive Storage

Question

Hi,
I would like to confirm the appropriate path, log archive storage, and retention details for Azure. Could you kindly validate the current setup and provide confirmation on the following:

Retention period applied to Azure logs

Path/location of the log archive storage

Any specific compliance requirements being followed

Your confirmation will help ensure proper log management and audit readiness.

Thank you for your assistance.

Answer 1

Hi @Benleo Cagampang,

Thank you for reaching out on Microsoft Q&A forum.

I understand you’d like confirmation on the retention period, log archive storage location, and compliance coverage for your Azure logging setup. In addition to what @Michele Ariis have shared, please see the details below.

1. Retention Period for Azure Logs

Azure provides flexible retention depending on the log type:

1.Activity Logs

• Retained 90 days by default at no cost.
• For longer retention, configure diagnostic settings to send logs to a Storage Account, Log Analytics workspace, or Event Hub.
• Activity Logs – Microsoft Learn

2.Log Analytics Workspace (Azure Monitor / Microsoft Sentinel)

• Default retention is 30–90 days depending on table type.
• Configurable up to 730 days (2 years) for analytics.
• With long-term retention, logs can be kept up to 4383 days (12 years).
• Configure retention – Microsoft Learn

3.Diagnostic Logs (Resource logs)

• You can set a retention policy up to 365 days in the portal.
• For longer retention, set retention to 0 days and manage deletion manually via lifecycle rules in the storage account.

2. Path / Location of Log Archive Storage

Logs can be archived to Azure Storage using diagnostic settings. The key details are:

1.Azure Blob Storage

• Logs are stored in a special $logs container or in a container defined during diagnostic setup.
• Suitable for long-term retention and compliance storage.

2.Storage Tiers (cost and access optimized):

• Hot Tier → frequently accessed logs (first 30–90 days).
• Cool Tier → infrequent access (90–365 days).
• Archive Tier → long-term retention (1–7+ years).

3.Archive in Log Analytics

• Data older than the analytics retention window is kept in long-term retention.
• Query access requires Search Jobs or restoring data back to the analytics tier.

References:

• Diagnostic settings in Azure Monitor
• Archive Tier in Azure Monitor Logs

3. Compliance Requirements

Azure Storage and Log Analytics comply with a wide range of global and industry standards, including:

• ISO 27001, SOC 1/2/3, PCI DSS, HIPAA, FedRAMP, HITRUST, CSA STAR, and DoD.
• These certifications apply to services like Blob Storage, Azure Data Lake, Files, Queues, and Tables.
• Azure Compliance Offerings – Microsoft Learn

Best practices for compliance and audit readiness:

• Use Azure Policy to enforce retention and diagnostic settings.
• Automate lifecycle management via Azure Functions or Logic Apps.
• Regularly review logs and optimize costs using Azure Monitor Workbooks and Cost Management tools.

Summary:

• Activity Logs → 90-day default, exportable for longer retention.
• Log Analytics → up to 2 years analytics, 12 years long-term retention.
• Storage Accounts → $logs container, with hot/cool/archive tiers for cost-efficient storage.
• Compliance → Azure meets major global standards; lifecycle automation + policy enforcement recommended.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hi, 1) Where logs go: on each resource (and on Subscription/Activity Log and Login ID) open Diagnostic settings and note destinations (Log Analytics, Storage, Event Hub); 2) Effective retention: in Log Analytics workspace → Usage & costs → Data retention (hot at workspace level) and in Workspace → Tables check/enforce per-table plan + Archive (e.g. 90 days hot + 1–7 years archive); for Storage retention/purge is done with Lifecycle Management (move Cool/Archive, delete after N days); Event Hub is streaming only with short retention; 3) Archive path on Storage: container insights-logs-* / insights-metrics-* with path like resourceId=/SUBSCRIPTIONS/.../y=YYYY/m=MM/d=DD/h=HH/...json; 4) Typical compliance: many policies require ≥90 days “hot” viewable + ≥1 year total (compliant for PCI/ISO/SOC2 etc.); 5) Confirmation to report: Destinations (Workspace X, Storage acct/containers, Event Hub), Retention workspace (X days), Override per table (e.g. SigninLogs 180d hot + 2y archive), Lifecycle rules (<rule>: delete after N days), Verified path (insights-logs-* with resourceId and y/m/d), Compliance outcome (pass/fail).