Question

A financial services company must retain Azure Active Directory (Microsoft Entra ID) sign-in and audit logs for 7 years to satisfy regulatory requirements. The logs must be tamper-proof, and auditors will occasionally perform ad-hoc queries against the most recent 90 days of data using KQL. The solution should minimize ongoing storage cost for the older data while ensuring it cannot be modified or deleted before the retention period expires. Which logging solution should you recommend?

Accepted Answer

Configure diagnostic settings to send logs to a Log Analytics workspace with 90-day retention, and also archive to an immutable Azure Storage account with a time-based retention policy and legal hold.

Answer

Send the logs to a Log Analytics workspace with 7-year interactive retention configured on the tables.

Answer

Configure diagnostic settings to send logs only to an Azure Event Hub that forwards to a third-party SIEM for retention.

Answer

Send logs to a Log Analytics workspace and enable the Auxiliary logs plan for all tables to reduce cost over 7 years.