Edit

How to archive Microsoft Entra activity logs to an Azure storage account

  • Article

If you need to store Microsoft Entra activity logs for longer than the default retention period, you can archive your logs to a storage account. We recommend that you use a general storage account and not a Blob storage account. For storage pricing information, see the [Azure Storage pricing calculator]. We recommend that you use a general storage account and not a Blob storage account. For storage pricing information, see the Azure Storage pricing calculator.

Prerequisites

To use this feature, you need:

  • An Azure subscription. If you don't have an Azure subscription, you can sign up for a free trial.
  • An Azure storage account you have ListKeys permissions for.
  • A user who's a Security Administrator or Global Administrator for the Microsoft Entra tenant.

Archive logs to an Azure storage account

  1. Sign in to the Microsoft Entra admin center as at least a Security Administrator.

  2. Browse to Identity > Monitoring & health > Diagnostic settings. You can also select Export Settings from either the Audit Logs or Sign-ins page.

  3. Select + Add diagnostic setting to create a new integration or select Edit setting for an existing integration.

  4. Enter a Diagnostic setting name. If you're editing an existing integration, you can't change the name.

  5. Select the log categories that you want to stream.

  1. Under Destination Details select the Archive to a storage account check box.

  2. Select the appropriate Subscription and Storage account from the menus.

    Screenshot of the diagnostic settings

  3. After the categories have been selected, in the Retention days field, type in the number of days of retention you need of your log data. By default, this value is 0, which means that logs are retained in the storage account indefinitely. If you set a different value, events older than the number of days selected are automatically cleaned up.

    Note

    The Diagnostic settings storage retention feature is being deprecated. For details on this change, see Migrate from diagnostic settings storage retention to Azure Storage lifecycle management.

  4. Select Save to save the setting.

  5. Close the window to return to the diagnostic settings page.

Next steps