Question

A financial services company must retain audit logs for specific privileged administrator accounts for two years to satisfy a regulatory investigation requirement, while all other user audit logs only need the default retention. The security architect wants to implement this using Microsoft Purview Audit without over-retaining data for the entire tenant. Which approach best meets these requirements?

Accepted Answer

Enable Audit (Premium) and create a custom audit log retention policy scoped to the privileged admin users with a two-year retention duration.

Answer

Enable Audit (Standard) which automatically retains all administrator activity for two years by default.

Answer

Configure a tenant-wide two-year retention policy in Audit (Premium) and apply Purview data lifecycle retention labels to exclude non-admin users.

Answer

Export all audit logs to a Log Analytics workspace and set a two-year table retention, deleting logs for non-admin accounts with a scheduled query.