Configure data retention and archive policies in Azure Monitor Logs

Retention policies define when to remove or archive data in a Log Analytics workspace. Archiving lets you keep older, less used data in your workspace at a reduced cost.

This article describes how to configure data retention and archiving.

How retention and archiving work

Each workspace has a default retention policy that's applied to all tables. You can set a different retention policy on individual tables.

Diagram that shows an overview of data retention and archive periods.

During the interactive retention period, data is available for monitoring, troubleshooting, and analytics. When you no longer use the logs, but still need to keep the data for compliance or occasional investigation, archive the logs to save costs.

Archived data stays in the same table, alongside the data that's available for interactive queries. When you set a total retention period that's longer than the interactive retention period, Log Analytics automatically archives the relevant data immediately at the end of the retention period.

If you change the archive settings on a table with existing data, the relevant data in the table is also affected immediately. For example, you might have an existing table with 30 days of interactive retention and no archive period. You decide to change the retention policy to eight days of interactive retention and one year total retention. Log Analytics immediately archives any data that's older than eight days.

You can access archived data by running a search job or restoring archived logs.

Note

The archive period can only be set at the table level, not at the workspace level.

When you shorten an existing retention policy, it takes 30 days for Azure Monitor to remove data, to prevent data loss in error configuration, and let you revert it. You can purge data immediately when required.

Configure the default workspace retention policy

You can set the workspace default retention policy in the Azure portal to 30, 31, 60, 90, 120, 180, 270, 365, 550, and 730 days. You can set a different policy for specific tables by configuring the retention and archive policy at the table level. If you're on the free tier, you'll need to upgrade to the paid tier to change the data retention period.

To set the default workspace retention policy:

  1. From the Log Analytics workspaces menu in the Azure portal, select your workspace.

  2. Select Usage and estimated costs in the left pane.

  3. Select Data Retention at the top of the page.

    Screenshot that shows changing the workspace data retention setting.

  4. Move the slider to increase or decrease the number of days, and then select OK.

Set retention and archive policy by table

By default, all tables in your workspace inherit the workspace's interactive retention setting and have no archive policy. You can modify the retention and archive policies of individual tables, except for workspaces in the legacy Free Trial pricing tier.

You can keep data in interactive retention between 4 and 730 days. You can set the archive period for a total retention time of up to 2,556 days (seven years).

To set the retention and archive duration for a table in the Azure portal:

  1. From the Log Analytics workspaces menu, select Tables.

    The Tables screen lists all the tables in the workspace.

  2. Select the context menu for the table you want to configure and select Manage table.

    Screenshot that shows the Manage table button for one of the tables in a workspace.

  3. Configure the retention and archive duration in the Data retention settings section of the table configuration screen.

    Screenshot that shows the data retention settings on the table configuration screen.

Get retention and archive policy by table

To view the retention and archive duration for a table in the Azure portal, from the Log Analytics workspaces menu, select Tables.

The Tables screen shows the interactive retention and archive period for all the tables in the workspace.

Screenshot that shows the Manage table button for one of the tables in a workspace.

Purge retained data

If you set the data retention policy to 30 days, you can purge older data immediately by using the immediatePurgeDataOn30Days parameter in Azure Resource Manager. The purge functionality is useful when you need to remove personal data immediately. The immediate purge functionality isn't available through the Azure portal.

Workspaces with a 30-day retention policy might keep data for 31 days if you don't set the immediatePurgeDataOn30Days parameter.

You can also purge data from a workspace by using the purge feature, which removes personal data. You can't purge data from archived logs.

The Log Analytics Purge API doesn't affect retention billing. To lower retention costs, decrease the retention period for the workspace or for specific tables.

Tables with unique retention policies

By default, two data types, Usage and AzureActivity, keep data for at least 90 days at no charge. When you increase the workspace retention to more than 90 days, you also increase the retention of these data types. You'll be charged for retaining this data beyond the 90-day period. These tables are also free from data ingestion charges.

Tables related to Application Insights resources also keep data for 90 days at no charge. You can adjust the retention policy of each of these tables individually:

  • AppAvailabilityResults
  • AppBrowserTimings
  • AppDependencies
  • AppExceptions
  • AppEvents
  • AppMetrics
  • AppPageViews
  • AppPerformanceCounters
  • AppRequests
  • AppSystemEvents
  • AppTraces

Pricing model

The charge for maintaining archived logs is calculated based on the volume of data you archive, in GB, and the number or days for which you archive the data.

For more information, see Azure Monitor pricing.

Set data retention for classic Application Insights resources

Workspace-based Application Insights resources store data in a Log Analytics workspace, so it's included in the data retention and archive settings for the workspace. Classic Application Insights resources have separate retention settings.

The default retention for Application Insights resources is 90 days. You can select different retention periods for each Application Insights resource. The full set of available retention periods is 30, 60, 90, 120, 180, 270, 365, 550, or 730 days.

To change the retention, from your Application Insights resource, go to the Usage and estimated costs page and select the Data retention option.

Screenshot that shows where to change the data retention period.

A several-day grace period begins when the retention is lowered before the oldest data is removed.

The retention can also be set programmatically with PowerShell by using the retentionInDays parameter. If you set the data retention to 30 days, you can trigger an immediate purge of older data by using the immediatePurgeDataOn30Days parameter. This approach might be useful for compliance-related scenarios. This purge functionality is only exposed via Azure Resource Manager and should be used with extreme care. The daily reset time for the data volume cap can be configured by using Azure Resource Manager to set the dailyQuotaResetTime parameter.

Next steps