Audit Retention Rebuilt Before It Was Needed at a 2,200-employee Government Agency
The agency assumed it had a year of audit history and actually had 180 days. We moved it to Audit Premium with 10 years retention on the record types that matter, and eleven months later those logs scoped a mailbox compromise in 4 days instead of guessing.
About the Client
The Challenge
The agency's security team believed it had a year of unified audit history. It had 180 days — the Audit Standard default, with anything generated before 17 October 2023 keeping only 90. The number still catches teams out, because much of the secondary material online quotes the older figure. It suits operational troubleshooting and not the investigations a public body faces, most of them reported months after the fact.
The gap was not only duration. The agency could see that an account signed in and a message was sent, but had no usable record of which mailbox items were opened and no retention long enough to hold one. When an account is compromised that is the question everyone asks: what did they read. Without those records everything the account could reach is exposed, which for a caseworker mailbox means notifying every constituent whose file passed through it.
Getting data out was its own obstacle. The portal caps results, and the team had a habit of narrowing searches until they returned something manageable rather than the right thing. The scripted PowerShell path returns bounded pages and must be paginated carefully, which nobody had documented.
The agency also had an open question it could not answer. An earlier consent-phishing campaign had touched an unknown number of accounts, and the records that would have established the blast radius had aged out. That incident funded the work.
Our Approach
Audit configuration is cheap, invisible and worthless until the day you need it, which is why it is usually done after the incident rather than before. We treated it as an evidence programme with a retention requirement driven by how late investigations arrive.
Retention Requirement, Not Retention Default (Weeks 1-3)
Started from the legal question: how long after an event might the agency first learn of it. Public records litigation, inspector general referrals and constituent complaints routinely surface events well over a year old. We mapped record types against that timeline and set 10 years on the categories supporting investigation — Exchange mailbox activity, SharePoint file access, Entra ID sign-in and directory changes, administrative actions — rather than one long period on everything.
Audit Premium and Targeted Retention Policies (Weeks 2-6)
Moved the tenant to Audit Premium, which is not one retention number but three. For E5-licensed users it holds Exchange, SharePoint, OneDrive and Microsoft Entra activity for a year and everything else for 180 days; non-E5 and guest users stay at 180 throughout. Anything longer needs the ten-year add-on, which is not retroactive — it governs records generated after purchase, the most important sentence in the business case, because buying it during an incident buys nothing for that incident. We then wrote custom retention policies. Up to 50 are allowed and they take priority over the defaults, so a baseline sits underneath and higher-priority policies extend specific record types and high-value accounts, each documented against the obligation behind it.
High-Value Events and the Mailbox Access Question (Weeks 5-9)
Mailbox item access auditing records the messages an account touched, across POP, IMAP, MAPI, EWS, ActiveSync and REST. The mechanics decide what an investigator can claim. A bind record is per message and carries its internet message identifier, with operations inside a two-minute interval rolled into one record and an operation count. A sync record is per folder, and a sync means the whole folder is compromised. Both are deduplicated on a one-hour window, so a quiet log is not an inactive account — though a fresh record is written whenever the client IP, client string, parent folder, logon type, mailbox UPN or session identifier changes. Premium adds a sensitivity label property, so the team can state whether what was accessed was classified rather than infer it. Search query auditing was enabled alongside.
Export Paths and Search Discipline (Weeks 8-12)
Documented three retrieval paths: the portal for triage inside its result cap, the PowerShell search cmdlet with session-based pagination for bounded exports, and the Management Activity API for bulk collection. That API runs at a baseline of 2,000 requests a minute, roughly doubled for E5 tenants, which is what makes continuous collection realistic. The habit of narrowing a query until it fit the cap was replaced with a procedure for splitting a search by time window and record type.
Sentinel Integration and Rehearsal (Weeks 11-16)
Streamed Microsoft 365 and Entra ID audit data into Microsoft Sentinel for detection, with long-tail history in the cheaper tier and queried through search jobs when needed. Analytics rules were written for the patterns that had gone unnoticed, including consent grants to unverified applications and anomalous mailbox synchronisation. The configuration was rehearsed against a tabletop scenario alongside the agency's eDiscovery process.
Solution Architecture
Licensing and retention: Audit Premium, up to 50 custom retention policies evaluated by priority — a baseline plus longer periods for investigation-relevant record types and key accounts
High-value events: Mailbox item access auditing with bind and sync records and the sensitivity label property, search query auditing, and administrative activity at the longest retention tier
Retrieval: Portal search for triage, session-paginated PowerShell export for bounded collections, and the Management Activity API at 2,000 requests a minute for bulk ingestion
SIEM: Microsoft 365 and Entra ID audit streams into Sentinel for detection, with long-tail history in a low-cost tier queried through search jobs
Governance: Each policy documented against the obligation that justifies it, reviewed annually alongside records management schedules
Results
Client identity withheld under confidentiality. Figures are representative of engagements of this scope.
Technologies Used
Key Takeaways
If your organization is facing a similar challenge, here's what we learned:
Your audit retention should be set by how late investigations arrive. Standard gives you 180 days. If complaints, referrals and litigation routinely surface events over a year old, every answer is a guess — and the ten-year add-on will not fill the gap behind you, because it is not retroactive.
Mailbox item access auditing is the difference between scoping and notifying. Without it you cannot say which messages a compromised account opened, so you assume all of them. With it you prove which mailboxes and records were never touched, and the notification obligation shrinks.
Know what the log deduplicates before you read it as quiet. Bind and sync events are filtered on a one-hour window, and binds inside two minutes collapse into one record with a count. An investigator who does not know that reads compression as inactivity. The fields forcing a fresh record are how you tell sessions apart.
The portal search cap trains bad habits. Narrowing a query until the results fit is not narrowing it until they are right. Split by time window and record type, and use the scripted or API path when volume warrants.
Detection and evidence are different storage problems. Hot SIEM ingestion for detection, cheap long-tail retention queried on demand for evidence. Paying premium rates to keep years of routine activity hot is how audit budgets get cut.
Related Case Studies
How Far Back Does Your Audit Log Actually Go?
Most tenants assume more history than they have, and find out during an investigation. We configure Audit Premium retention against the real investigation timeline and prove it with a rehearsal.