Microsoft Sentinel

Sentinel data retention – extend to 90 days

Level: Beginner | Reading time: 5 minutes

Microsoft Sentinel offers some data retention configurations that can help you to retain important logs for further investigation. It’s important to understand the benefits you have when it comes to data retention and ingestion, such as:

  • The first 31 days of data ingestion are free
  • 90 days free for data retention on the Log Analytics workspace

However, the 90-day period is not enabled by default. If you take a look at your Log Analytics Data Retention blade, you will see 30 days as the default value.

To increase this value, just type 90 days or slide it to the right.

Learn More:

Configure data retention and archive in Azure Monitor Logs (Preview) – Azure Monitor | Microsoft Docs

Tiago Souza

Tiago Souza

Security Technical Specialist
Cyber Security Technical Specialist at Microsoft | Cloud Security & Threat Protection | Blog content creator at CyberGeeks.Cloud -