22/06/2026
Your Microsoft 365 audit logs retain up to 180 days of activity. That sounds like more than enough, until you need to reconstruct four months of a user's behaviour for an HR matter, a security incident, or a legal question.
The compliance portal is not the right tool for that. It was built for everyday lookups, not systematic extraction at volume. And the moment you hit day 181, whatever was there is gone permanently.
We have written about how to approach this properly — what tools to use, what the data actually looks like, and what managed threat detection changes about the equation.
Read the full blog here:
Your M365 audit logs delete after 180 days — and the compliance portal can't handle bulk investigations. What IT managers need to know.