How Long Does Microsoft 365 Keep SharePoint Audit History?

The short answer: 180 days with Audit (Standard), one year with Audit (Premium), and up to ten years with the additional retention add-on license. The longer answer matters because those numbers describe how long event records survive, and event records are not the same thing as a history of who had access.

This guide lays out the retention rules as Microsoft documents them, the practical caveats, and what you have to do yourself if you need to answer questions further back.

Retention by licensing tier

Microsoft Purview Audit comes in two tiers, and the tier is determined per user by licensing.

Two details trip people up:

• Retention is evaluated per user, by the license of the user who performed the action, not by the tenant. In a mixed tenant, an E5 administrator's actions are kept for a year while an E3 site owner's actions are kept for 180 days.
• The increase from 90 to 180 days applied to records generated after the change. Older records did not retroactively gain retention.

Always confirm the current values against Microsoft's documentation for your tenant's licensing; Microsoft has changed these numbers before and will again.

What "audit retention" actually retains

The Unified Audit Log stores events: a record that something happened, when, by whom, to what. For SharePoint permissions that means operations such as PermissionLevelAdded, SharingInheritanceBroken, AddedToGroup and the sharing link events. For Entra ID it means Add member to group. and its relatives.

It does not store state. There is no record that says "on 14 February, the Payroll folder's role assignments were X." To know that you need a snapshot from around that time plus the events since, which is the reconstruction approach described in How to Audit Historical SharePoint Permissions.

Audit delay: how soon does an event appear?

Audit records are not written synchronously with the action. Microsoft documents that most SharePoint and OneDrive events are available in the log within an hour, while some workloads and some events take considerably longer, up to 24 hours in documented cases. Audit ingestion is a delayed pipeline, and anything built on it must be too.

Practical consequences:

• Do not treat absence as evidence for recent time windows. If you search for a change made twenty minutes ago and find nothing, that is not proof it did not happen.
• Order by the event's own timestamp, CreationDate or CreationTime, not by when your export ran.
• Overlap your export windows so a record that arrived late still lands in a later export.
• Expect corrections. A state you reconstructed at 10:00 may need revising at 11:00 when a delayed event arrives. Keep the revision, do not overwrite it.

The Entra ID audit log is a separate clock

Directory group membership changes appear in two places: the Unified Audit Log (Azure Active Directory workload, subject to the retention above) and Entra ID's own audit log in the Entra admin center. Entra ID's log retains 30 days with Entra ID P1 or P2 licensing and 7 days on the free tier. If you rely on the Entra ID portal for group history, your window is much shorter than the Unified Audit Log's.

Checking what your tenant actually has

Verify that auditing is on and see what the search returns for your oldest window:

Connect-ExchangeOnline
Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled

# Probe the edge of retention: does anything come back from ~180 days ago?
$end   = (Get-Date).ToUniversalTime().AddDays(-178)
$start = $end.AddDays(-2)
Search-UnifiedAuditLog -StartDate $start -EndDate $end -RecordType SharePoint -ResultSize 10 |
  Select-Object CreationDate, Operations, UserIds

If auditing was ever switched off, there is a gap for that period that no license will fill.

To see which users are on which tier, check assigned licenses and service plans; the Audit (Premium) service plan is what determines one-year retention for a given actor's records.

Extending your history beyond retention

If the questions you need to answer go further back than your retention, or need state rather than events, you have three options:

1. Buy longer retention. The 10-year add-on extends event retention, but still only events, and only for licensed users.
2. Export continuously and keep the exports. A scheduled Search-UnifiedAuditLog or Graph audit query job, run daily with overlapping windows, gives you an event archive under your own retention policy. Store it in your own database with the raw AuditData preserved.
3. Take periodic permission baselines alongside the exports. Baselines plus events are what let you reconstruct state, not just list changes.

A minimal daily export job:

$sessionId = "spo-audit-" + (Get-Date -Format "yyyyMMdd")
$start = (Get-Date).ToUniversalTime().Date.AddDays(-2)   # two-day overlap for late arrivals
$end   = (Get-Date).ToUniversalTime()
do {
  $batch = Search-UnifiedAuditLog -StartDate $start -EndDate $end -RecordType SharePoint `
    -SessionId $sessionId -SessionCommand ReturnLargeSet -ResultSize 5000
  $batch | Export-Csv "ual-spo-$($end.ToString('yyyyMMdd')).csv" -Append -NoTypeInformation
} while ($batch.Count -eq 5000)

Deduplicate on the record Identity when you load the overlapping windows.

FAQ

Does turning on Audit (Premium) recover older records?

No. Retention applies going forward from when the record was created under the applicable tier. Records that already expired are gone.

Are SharePoint file access events kept for the same period?

Yes. FileAccessed, FileDownloaded and similar operations are ordinary audit records under the SharePoint workload and follow the same tier-based retention as permission operations.

Is the audit log a legally sufficient record of who could access data?

That is a question for your auditors and counsel, but technically the log records changes, not entitlements. A defensible entitlement history needs baselines as well as events.

Related reading

• How to Audit Historical SharePoint Permissions
• How to Investigate Who Changed SharePoint Permissions
• How to Review External User and Guest Access in SharePoint Online