This is the Trace Id: c3f100cbfde946369f10ae4f39081607
Skip to main content Why Microsoft Security AI-powered cybersecurity Cloud security Data security & governance Identity & network access Privacy & risk management Security for AI Unified SecOps Zero Trust Microsoft Defender Microsoft Entra Microsoft Intune Microsoft Priva Microsoft Purview Microsoft Sentinel Microsoft Security Copilot Microsoft Entra ID (Azure Active Directory) Microsoft Entra Agent ID Microsoft Entra External ID Microsoft Entra ID Governance Microsoft Entra ID Protection Microsoft Entra Internet Access Microsoft Entra Private Access Microsoft Entra Permissions Management Microsoft Entra Verified ID Microsoft Entra Workload ID Microsoft Entra Domain Services Azure Key Vault Microsoft Sentinel Microsoft Defender for Cloud Microsoft Defender XDR Microsoft Defender for Endpoint Microsoft Defender for Office 365 Microsoft Defender for Identity Microsoft Defender for Cloud Apps Microsoft Security Exposure Management Microsoft Defender Vulnerability Management Microsoft Defender Threat Intelligence Microsoft Defender Suite for Business Premium Microsoft Defender for Cloud Microsoft Defender Cloud Security Posture Mgmt Microsoft Defender External Attack Surface Management Azure Firewall Azure Web App Firewall Azure DDoS Protection GitHub Advanced Security Microsoft Defender for Endpoint Microsoft Defender XDR Microsoft Defender for Business Microsoft Intune core capabilities Microsoft Defender for IoT Microsoft Defender Vulnerability Management Microsoft Intune Advanced Analytics Microsoft Intune Endpoint Privilege Management Microsoft Intune Enterprise Application Management Microsoft Intune Remote Help Microsoft Cloud PKI Microsoft Purview Communication Compliance Microsoft Purview Compliance Manager Microsoft Purview Data Lifecycle Management Microsoft Purview eDiscovery Microsoft Purview Audit Microsoft Priva Risk Management Microsoft Priva Subject Rights Requests Microsoft Purview Data Governance Microsoft Purview Suite for Business Premium Microsoft Purview data security capabilities Pricing Services Partners Cybersecurity awareness Customer stories Security 101 Product trials Industry recognition Microsoft Security Insider Microsoft Digital Defense Report Security Response Center Microsoft Security Blog Microsoft Security Events Microsoft Tech Community Documentation Technical Content Library Training & certifications Compliance Program for Microsoft Cloud Microsoft Trust Center Service Trust Portal Microsoft Secure Future Initiative Business Solutions Hub Français Contact Sales Start free trial Microsoft Security Azure Dynamics 365 Microsoft 365 Microsoft Teams Windows 365 Microsoft AI Azure Space Mixed reality Microsoft HoloLens Microsoft Viva Quantum computing Sustainability Education Automotive Financial services Government Healthcare Manufacturing Retail Find a partner Become a partner Partner Network Microsoft Marketplace Marketplace Rewards Software development companies Blog Microsoft Advertising Developer Center Documentation Events Licensing Microsoft Learn Microsoft Research View Sitemap

Go deep on real code and real systems at Microsoft Build, June 2-3.

Learn more

Microsoft Purview Audit

Power your forensic and compliance investigations.

A man working on a desk with a sheet of paper and a pen.

Latest news on changes coming to Audit

Learn more about the changes coming to Audit, including longer default retention and additional audit logging events.

Power your forensic and compliance investigations

Support forensic investigations

Determine the scope of compromise and access audit logs to support investigations.

Preserve audit logs to meet regulatory requirements

Retain audit records for one year with the option to retain for up to 10 years.

Gain high-bandwidth access to data

Get a dynamic bandwidth quota to access your auditing data.

Key features of Microsoft Purview Audit (Premium)

Screen review of customized retention dashboard.

Customized retention policies

Create customized audit log retention policies to retain audit records based on the service where the audited activities occur, specific audited activities, or the user who performs an audited activity.

Screenshot of retention policy options dashboards.

Longer retention of audit records

Retain Audit (Premium) users' audit log records of Exchange, SharePoint, OneDrive, and Microsoft Entra ID for one year by default and 180 days for all other activities. Retain audit log records for up to 10 years with an add-on license.

Screenshot of a crucial events report example.

Intelligent insights

Support investigations by providing visibility to events such as when mail items were accessed, replied to and forwarded, or when and what a user searched for in Exchange Online and SharePoint Online.

A diagram of the management activity A P I.

Higher API bandwidth access

Organizations are initially allocated a baseline of 2,000 requests to the Office 365 Management Activity API per minute, where this limit will dynamically increase depending on an organization's seat count and their licensing subscription, resulting in about twice the bandwidth as organizations with Audit (Standard).

Back to tabs

How Audit powers your investigations

Audit provides crucial event data that can help you investigate possible breaches and determine the scope of compromise.

Image of various Microsoft services that send data to audit for user focused events for investigations

Microsoft Purview Suite

Originally starting from CAD $16.30 now starting from CAD $16.30

CAD $16.30 CAD $16.30

user/month, paid yearly

(annual commitment)

Additional resources

Get more information about Microsoft Purview Audit—formerly Advanced Audit in Microsoft 365.

Blog

Audit blog

Check out the blog for the latest updates and insights around Audit.

Guide

Interactive guide

Explore the interactive guide to better understand how to conduct forensic investigations with Audit.

Docs

Learn more about audit scenarios

Dive into the Audit module to track user and admin activities on Microsoft Learn.

FAQ

Frequently asked questions about Audit

Get answers to common questions about Audit.

Protect everything

Make your future more secure. Explore your security options today.

Follow Microsoft Security