Activity Logs Retention in Azure: How Long

Azure activity logs are retained for 90 days by default, after which they are automatically purged unless you route them to a Log Analytics workspace or another storage destination. This 90‑day window applies to the platform-level activity log (formerly known as the audit log) that records subscription-level events such as resource creation, configuration changes, and administrative actions.

What the Activity Log Actually Contains

The Azure activity log is a subscription-level log that records every write operation (PUT, POST, DELETE) performed on resources in your subscription. It does not capture read operations or the internal activity of a resource (for example, a virtual machine’s OS-level events). Typical entries include:

• Who created, modified, or deleted a resource and when
• Which operation was performed (e.g., Microsoft.Compute/virtualMachines/write)
• The status of the operation (Succeeded, Failed, Accepted)
• Caller information (user, service principal, or application ID)
• Correlation ID for tracking related events

Because it is a subscription-level log, it is not the same as resource-level diagnostic logs (like application logs or IIS logs). Those are separate and have their own retention settings.

Default Retention Period and What Happens After

By default, Azure stores activity log events for 90 days from the moment the event occurs. After that period, the events are permanently deleted from the Azure platform’s internal storage. You cannot retrieve them from the portal or via any API once they have aged out, unless you have configured an export to a longer-term destination.

This 90-day limit is a hard platform constraint. Microsoft does not offer a way to extend the default retention within the activity log itself. The only way to keep activity log data longer is to route it to a Log Analytics workspace (for up to 2 years or more depending on your workspace retention plan) or to an Azure Storage account or Event Hub (where you control the retention policy).

How to Extend Retention: Export Options

To keep activity log data beyond 90 days, you must configure a diagnostic setting on the activity log. This setting streams the log to one of three destinations:

• Log Analytics workspace: Enables advanced querying with KQL, alerts, and integration with other Azure logs. Retention is configurable from 30 days up to 730 days (2 years) for most workspaces, and you can use archive policies for longer periods.
• Azure Storage account: Provides low-cost long-term archival. You can set a retention policy on the storage container (from 1 day to the maximum storage account retention, which is effectively indefinite if you set it to 0).
• Event Hub: Streams events to external SIEM tools or custom analytics pipelines. Retention is controlled by the Event Hub’s message retention (1 to 7 days) unless you forward to a storage sink.

Once you create a diagnostic setting, the activity log is continuously exported to your chosen destination. You can have multiple settings, but each event generates one copy per setting, which may affect cost.

Choosing the Right Retention Strategy

Your choice depends on your compliance, security, and operational needs. Consider these factors:

• Compliance requirements: Many regulations (e.g., GDPR, HIPAA, ISO 27001) require audit logs to be kept for a specific period – often 1 to 7 years. If you have such obligations, you need a long-term archival solution like Azure Storage.
• Security investigations: If you need to investigate incidents that occurred more than 90 days ago, you need the data in Log Analytics or Storage.
• Cost: Log Analytics charges for data ingestion and retention. Storage is cheaper for cold archival but less convenient for querying. Event Hub is useful for real-time streaming but not for long-term storage.
• Operational troubleshooting: For day-to-day issues, the 90-day default is often sufficient, but you may want to keep a rolling year for trend analysis.

A common practice is to send activity logs to a Log Analytics workspace for 1 year (for interactive queries) and simultaneously to a storage account with a retention policy of 7 years (for compliance). This dual export gives you both agility and durability.

Common Problems and Misconceptions

One common misconception is that the activity log is stored in the subscription’s “Activity Log” blade indefinitely. In reality, the blade only shows events from the last 90 days. If you don’t export, older events are gone.

Another issue is that diagnostic settings are not retroactive. When you enable export, only events that occur after the setting is created are sent. You cannot backfill historical activity log data. So if you have a compliance need, configure export as early as possible.

Also, be aware that the activity log does not include read-only events. If you need to track who accessed a resource (e.g., a VM or a database), you need to enable resource-level diagnostic logs or use Azure Policy to audit access.

Costs and Pricing Considerations

Exporting activity logs incurs costs depending on the destination:

• Log Analytics: You pay for data ingestion (per GB) and data retention (per GB per month). The first 5 GB per workspace per month is free, but activity log data can be substantial in large environments.
• Storage: You pay for storage capacity (per GB per month) and operations (write/read). Archival access tiers are cheaper but have retrieval costs.
• Event Hub: You pay for throughput units and any data egress if you stream to an external system.

To reduce costs, you can filter the activity log by category (Administrative, Service Health, Alert, Autoscale, Security, and Policy) when creating a diagnostic setting. For example, you might only export Administrative and Security events, ignoring Autoscale and Alert noise.

Security and Access Control

Activity log data can contain sensitive information about your infrastructure and user actions. Therefore, you should restrict access to the destinations where it is stored:

• Use Azure RBAC to grant only necessary permissions to the Log Analytics workspace or storage account.
• For storage, consider using a private endpoint and network access rules to prevent public exposure.
• Enable encryption at rest (Azure Storage and Log Analytics both encrypt by default).
• If you use Event Hub, ensure that the connection string is kept secure and use managed identities where possible.

Also, be mindful of data residency requirements. If you operate in regulated regions, choose a storage location that matches your compliance needs.

Frequently Asked Questions

Can I retrieve activity log data older than 90 days if I never exported it?

No. Once the 90-day window passes, the data is permanently deleted from Azure’s platform. You cannot recover it via the portal, CLI, or API. The only way to have historical data is to have configured an export before the events occurred.

What is the difference between activity log and diagnostic logs?

The activity log is a subscription-level log of control-plane operations (e.g., creating a VM). Diagnostic logs are resource-level logs that capture data-plane activity (e.g., application errors, security events). They have different retention defaults and are configured separately.

Does exporting to Log Analytics increase my cost significantly?

It can, depending on the volume of events. Activity log data is usually small compared to resource diagnostic logs, but in a busy subscription with many resources, it can add up. Use filters to limit which categories you export.

Can I set different retention periods for different categories?

No. A diagnostic setting exports all selected categories to the same destination with the same retention policy. If you need different retention, you must create separate diagnostic settings for each category, but that duplicates data and increases cost.

Is the activity log available for all Azure regions?

Yes, the activity log is available in all public Azure regions, including sovereign clouds (Azure Government, Azure China). However, retention and export features may vary slightly in sovereign clouds – check the documentation for your environment.

Activity Log Retention Template

If you have specific compliance or legal requirements, consult a qualified professional to ensure your retention strategy meets all applicable regulations.

Related

• School Administration Courses Online: What to Know
• School Administration Degree: What It Is & Career Paths
• DJ Manager Contract Advice: Key Terms and Template