Question

Your team stores application and infrastructure logs in a single Azure Monitor Log Analytics workspace. Compliance requires that a specific table, 'SecurityEvent', be retained and queryable for 30 days at interactive speed, but must remain retrievable for a total of 2 years to satisfy audit requests. Interactive retention across all tables is currently set to 90 days, which is inflating costs. You want to minimize storage costs while meeting the requirement with the least operational overhead. What should you configure?

Accepted Answer

Set the workspace default interactive retention to 30 days and configure a table-level archive (long-term) retention of 2 years on the SecurityEvent table.

Answer

Set the workspace default interactive retention to 2 years so all tables including SecurityEvent are retained, and rely on Basic logs to reduce ingestion cost.

Answer

Create a data export rule on the SecurityEvent table to a storage account and delete the table from the workspace after 30 days.

Answer

Set the SecurityEvent table interactive retention to 2 years and leave the workspace default at 90 days.