Question

A financial services organization must retain all Microsoft 365 audit records for seven years to satisfy a regulator, while its SOC needs near-real-time access to the same activity data in Microsoft Sentinel for detection and hunting. The compliance team owns retention policy; the SOC owns detection engineering. The architect must design centralized logging that meets long-term retention requirements without forcing the SOC to run costly full-fidelity queries in Sentinel just to satisfy compliance retention. Which design best separates these concerns while keeping both requirements met?

Accepted Answer

Enable Purview Audit (Premium) with a custom seven-year audit log retention policy for authoritative long-term retention, and ingest the Microsoft 365 audit stream into Sentinel with an operational retention period aligned to SOC detection needs.

Answer

Set the Sentinel workspace data retention to seven years for all Microsoft 365 tables so both compliance retention and SOC hunting are served from a single store.

Answer

Forward all Microsoft 365 audit events only to an Azure Storage account with immutable blob policies, and grant the SOC read access to run detections directly against the archived blobs.

Answer

Rely on the default 180-day Purview Audit (Standard) retention and export monthly CSV extracts to a SharePoint library for the seven-year regulatory requirement.