Question

A financial services company is finalizing the Well-Architected Framework review for a new Azure workload. The security team requires that all security-relevant logs (sign-ins, resource activity, and Defender alerts) be retained for 2 years to meet regulatory investigation requirements, while the cost team is concerned about escalating Log Analytics workspace ingestion and retention charges. The architect must reconcile the WAF Security pillar with the Cost Optimization pillar. Which approach best balances these competing priorities?

Accepted Answer

Reduce interactive retention in the Log Analytics workspace to the operational period needed for alerting and threat hunting, then move older data to a cheaper long-term/archive tier (auxiliary or archive) that still permits search jobs when an investigation requires it.

Answer

Keep all data in the Log Analytics workspace at interactive retention for the full 2 years to guarantee immediate query access for any investigation.

Answer

Export all logs to a general-purpose Azure Storage account with no immutability and delete the Log Analytics data after 30 days to minimize ingestion cost.

Answer

Disable diagnostic settings for lower-severity resources and retain only Defender high-severity alerts, discarding sign-in and activity logs to cut retention volume.