July 19, 2017

SharePoint Online Site Collection Admin Audit Log Retention

by jake

2 min read

No Comments
What is Site Collection Admin Audit Log?

Site Collection Admin Audit Log helps the administrators to keep a log of what is happening inside the site collection. Knowing who has done what with which information is critical for achieving regulatory compliance and record management.

Note: This option is not enabled by default as enabling this may potentially generate a large number of audit events.

What is the default retention period for the audit log?

By default, the audit log has 90 days retention period, but the administrator had more control over this retention period. Begining July 24th, 2017, there is a major change going to be rolled out regarding audit log retention.

What are the new changes to SharePoint Online Site Collection Admin Audit Logging?

Microsoft will be making changes to the SharePoint Online Site Collection Administration Audit Log feature by enforcing a 90-day retention period. Customers who used this feature previously will be automatically updated to the new retention policy and settings. New customers who subscribed to Office 365 after this change will be forced to use the 90-day retention period.

Important: This change does not impact the Unified Auditing experience from the Office 365 Security & Compliance Center.

When are these changes going to be rolled out?

Microsoft has planned to roll out this changes to its first Release enabled Office 365 Tenants from July 24th, 2017.

How can I view data beyond the 90-day retention period?

Once the 90-day retention period is met an Excel file will automatically get created in the document library specified. These files will contain audit data from specific periods of time.

Is there any solution to store activities for a longer time period?

Yes, PowerShell is always the savior whenever you bogged by certain limitations. But it takes more time to develop the required functionality and it may be error prone as this functionality requires scheduling. It’s better to implement a 3rd party auditing tool.

Solution: Already a full-fledged Office 365 Auditing Report Tool available for download from Microsoft TechNet Gallery. It allows you to keep track of all Office 365 auditing information to your local server for as long as it’s required.

You can know more about the announcement in Microsoft Tech Community.

Share article