The Maester's Archive: Why Your Entra Logs Vanish After 30 Days

Alright, Guardians....picture this.

Saturday morning, the fire alarm goes off. Everything in a production Azure subscription is gone. VMs, VNets, the infrastructure the business runs on, you name it. Deleted. Someone with the right access walked in and burned the castle down.

The Azure Activity log shows who pressed the button. That's the easy part. The question that actually matters comes next: how long was that user compromised? When did the attacker first get in? What else did they touch on the way? Did they set up a way back in?

Those answers live in the Entra sign-in and audit logs. And nobody had exported them. Thirty days of history, at best, and the trail went cold right where we needed it most.

In Westeros, the Maesters of the Citadel keep the records of the realm: every lineage, every treaty, every raven ever sent. Kings rise and fall, but the archive stays (unless a very angry King burns it to the ground...IYKYK). When someone needs to know what really happened, they go to Oldtown.

Your Entra tenant doesn't have a Citadel by default. It has a short memory and it forgets on a schedule. This post is about building your archive before you need it and about the Sentinel retention trick that makes it a lot cheaper than most people think.

If you'd rather watch than read, I walk through the setup in my Log Analytics video. This post is the why behind it. (And for my eager listeners/viewers, my next walkthrough will demonstrate how to transition a standard LAW into the Sentinel workspace)

How long Entra actually remembers

Entra ID keeps its activity logs for 30 days on P1 or P2, and only 7 days on Entra ID Free. Here's what Microsoft documents:

Three details catch people out:

• Upgrading doesn't bring anything back. Moving from Free to P1 or P2 doesn't restore older data. Retention changes aren't retroactive.
• Entra doesn't keep Microsoft Graph activity logs at all. Defender XDR may hold the last 30 days of Graph API requests in the GraphAPIAuditEvents advanced hunting table, depending on your licensing. Past that, if you want to know which app or user called Graph and what they asked for, you have to set up longer retention in advance.
• Purview isn't the same archive. The Microsoft 365 Unified Audit Log is separate from the Entra sign-in logs. E5 customers can keep Entra audit records longer through Purview Audit (Premium), but that doesn't cover sign-ins.

The bottom line: if you didn't export it before day 30, it's gone. There's no restore button and no ticket that gets it back.

What you can't investigate without the archive

Most real investigations start late. Attackers sit quietly, the alert fires weeks after the first sign-in, or someone in HR asks a question about last quarter. Here's what a 30-day window costs you:

• Finding patient zero. Business email compromise often starts with a token theft or a password spray weeks before anyone notices. Without older sign-in logs, you can see the attacker today but not how they got in.
• Scoping the blast radius. Which other accounts signed in from the same IP or device? That question only has an answer if the history exists.
• Tracing persistence. New app registrations, consent grants, added credentials, MFA method changes, and Conditional Access edits all live in the audit log. An attacker who planted a backdoor 45 days ago is invisible in a 30-day window.
• Insider and HR cases. "Did this user access anything after their resignation?" usually gets asked months later.
• Proving a negative. Cyber insurance, auditors, and legal will ask you to show that something didn't happen. You can't prove that from logs you don't have.
• Baselining normal. Detections like impossible travel or unusual app usage need weeks of history to know what normal looks like for a user.
• Compliance. Many frameworks expect a year or more of retained, searchable logs. Thirty days doesn't come close.

The Maesters didn't wait for a war to start writing things down. Neither should you.

Building the Citadel: send your logs to Log Analytics

The archive is a Log Analytics workspace, fed by Entra diagnostic settings. It takes about ten minutes to set up and I walk through every click in the video. The short version:

1. Create a Log Analytics workspace in an Azure subscription you control, in the region your data residency rules require.
2. Open diagnostic settings. In the Entra admin center, go to Entra ID > Monitoring & health > Diagnostic settings as at least a Security Administrator.
3. Add a diagnostic setting, pick your log categories, check Send to Log Analytics workspace, and choose your workspace.
4. Save, then verify. Give it about 15 minutes, then query the SigninLogs table to confirm data is arriving.

Which categories to send:

Microsoft notes that non-interactive and service principal sign-ins can run 5 to 10 times the volume of interactive sign-ins. Don't skip them to save money. They're often where the attacker actually is. Plan for the cost instead, which brings us to the good news.

The Sentinel retention trick: 90 days free

Here's the part most people miss. If you enable Microsoft Sentinel on your Log Analytics workspace, the first 90 days of retention are free. Ingestion is not. Retention is.

A plain Log Analytics workspace bills you for ingestion and past its included retention window, for every extra day you keep the data. Turn that workspace into a Sentinel workspace and Microsoft retains all ingested data at no charge for 90 days. You only start paying for retention past day 90. In Microsoft's own words: "Retain all data ingested into the workspace at no charge for the first 90 days. Retention beyond 90 days is charged per the standard Log Analytics retention prices." (Microsoft Learn)

So for the same ingestion bill, you triple the 30 days Entra gives you, and you get Sentinel's analytics rules, hunting, and workbooks on top.

What that looks like in practice:

A few things to get right:

• Set the retention to 90 days. Enabling Sentinel doesn't always change the number for you. Workspaces on older pricing can still default to 30 days and Microsoft recommends raising it to 90. Check the workspace and the individual tables under Data management > Tables.
• Entra logs aren't free to ingest. Sentinel does ingest some sources at no cost, like Azure Activity, Office 365 audit logs, and security alerts. Raw Entra sign-in and audit logs are paid data types.
• Go past 90 days with the data lake. For a year or more of history (compliance, insurance, long-tail investigations), extend total retention into the Sentinel data lake tier. It's a low-cost cold tier you can still query with KQL jobs, up to 12 years.
• Check your licensing. Sentinel has a 31-day free trial covering up to 10 GB a day, and Microsoft offers a Sentinel benefit for Microsoft 365 E5, A5, F5, and G5 customers. See whether either applies to you before you estimate costs.
• High volume? Look at commitment tiers. Once you're ingesting 100 GB a day or more, a commitment tier is usually cheaper than pay-as-you-go.

Pitfalls I see in the field

• Waiting for the incident. The day you need the logs is the day you learn they're gone. Turn on diagnostic settings now, even if nobody's looking at them yet.
• Only sending interactive sign-ins. It's tempting to skip non-interactive and service principal logs to save money. That's exactly where token replay and app abuse can hide.
• Leaving retention at 30 days. Plenty of Sentinel workspaces I review still sit at the old default. That's paying for ingestion and throwing away 60 free days.
• No Graph activity logs. Entra doesn't keep them and Defender XDR's advanced hunting copy only covers 30 days. Send them through diagnostic settings, or extend the XDR table's retention into Sentinel if your tenant supports it. They're the best record of which app pulled what from your tenant.
• One person holds the keys. Lock down who can delete or change the diagnostic setting and the workspace. An attacker with the right role can turn off your archive on the way in. Alert on changes to diagnostic settings.
• Nobody queries it. An archive no one reads is just a bill. Build a few saved queries or a workbook so the team actually uses the data.
• Forgetting the break-glass alert. Once logs are flowing, set up the emergency access sign-in alert from my break-glass post. It's the same workspace.

The Maester's checklist

• [ ] Log Analytics workspace created in the right subscription and region
• [ ] Entra diagnostic setting sending audit, interactive, non-interactive, service principal, and managed identity sign-in logs
• [ ] Risk logs, Microsoft Graph activity logs, and each subscription's Azure Activity log included (Azure Activity is free to ingest in Sentinel)
• [ ] Data confirmed arriving in SigninLogs and AuditLogs
• [ ] Microsoft Sentinel enabled on the workspace
• [ ] Workspace and table retention set to 90 days
• [ ] Data lake retention extended past 90 days if compliance requires it
• [ ] Access to the workspace and diagnostic settings locked down, with an alert on changes
• [ ] Ingestion costs estimated, including any trial or E5 benefit

The Citadel keeps its records not because every scroll matters, but because nobody knows in advance which one will. Your logs work the same way. You won't know which sign-in matters until the day it does, and by then it needs to already be on the shelf.

Thanks for reading, Guardians. I appreciate every one of you who shows up for these posts. If you want to see the whole setup end to end, watch the walkthrough on YouTube and subscribe to the channel. And if you've got a "the logs were already gone" story, drop it in the comments. I know I'm not the only one.

Stay vigilant out there.

— Kevin