Retrieving sign-in logs, or similar evidence, beyond 30 days in Entra

Question

Hi,

I have a user that I need to find evidence of having logged in, dating back to December 1, 2025. Nothing was configured previously to allow this. Entra only allows me to go back 30 days. I tried a compliance search, but the results came back blank. Perhaps I did not use the correct settings.

Is there any way to accomplish this? I currently have an E5 license and Global Admin access to the tenant.

---

Moved from Microsoft 365 and Office | Other

Answer 1

Dear @IanFrench,

Thank you for posting your question in the Microsoft Q&A forum.

Based on your description, you wonder is there any way to retrieve evidence of a user’s Entra ID sign-ins dating back to December 1, 2025, if no prior logging or export (Log Analytics, Sentinel, Storage, etc.) was configured and the built‑in 30‑day retention has already passed even with an E5 license and Global Admin access.

Unfortunately, If Entra ID sign‑in logs were not exported or archived before the 30‑day retention period expired, they cannot be retrieved retroactively even with an E5 license and Global Admin access. Compliance Search and Purview do not contain Entra sign‑in logs. Only future logs can be retained by configuring Diagnostic Settings (Log Analytics, Storage, Sentinel, etc.) in advance.

For reference Microsoft Entra data retention
In case you need further investigate or more information, I recommend you can contact to Microsoft Support team, they can help you deeper investigate your information. You can raise ticket via Admin portal In the Microsoft 365 Admin Center > Support > Help & Support. You can raise support ticket: https://admin.microsoft.com/#/support/requests Or use this link to find the appropriate contact number: Global Customer Service phone numbers - Microsoft Support  

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Unfortunately, Microsoft Entra does not retain sign-in logs beyond the default retention period, which is 30 days for users with an E5 license. Therefore, if you need to find evidence of a user's login activity dating back to December 1, 2025, it will not be possible to retrieve that information directly from Entra, as it only retains logs for the past 30 days.

To retain logs for longer periods, organizations typically need to configure log archiving to an Azure storage account using Azure Monitor. However, since the date in question is well beyond the retention limit, it would not be possible to access that historical data unless it was archived prior to the expiration of the retention period.

If you have not set up any archiving or monitoring solutions previously, you may need to consider implementing these for future needs to ensure that you can access historical data beyond the standard retention limits.