SharePoint Online Site Collection Admin Audit Log Retention

Site Collection Admin Audit Log helps the administrators to keep a log of what is happening inside the site collection. Knowing who has done what with which information is critical for achieving regulatory compliance and record management.

Note: This option is not enabled by default as enabling this may potentially generate a large number of audit events.

By default, the audit log has 90 days retention period, but the administrator had more control over this retention period. Begining July 24th, 2017, there is a major change going to be rolled out regarding audit log retention.

Microsoft will be making changes to the SharePoint Online Site Collection Administration Audit Log feature by enforcing a 90-day retention period. Customers who used this feature previously will be automatically updated to the new retention policy and settings. New customers who subscribed to Office 365 after this change will be forced to use the 90-day retention period.

Important: This change does not impact the Unified Auditing experience from the Office 365 Security & Compliance Center.

Microsoft has planned to roll out this changes to its first Release enabled Office 365 Tenants from July 24th, 2017.

Once the 90-day retention period is met an Excel file will automatically get created in the document library specified. These files will contain audit data from specific periods of time.

Yes, PowerShell is always the savior whenever you bogged by certain limitations. But it takes more time to develop the required functionality and it may be error prone as this functionality requires scheduling. It’s better to implement a 3rd party auditing tool.

Solution: Already a full-fledged Office 365 Auditing Report Tool available for download from Microsoft TechNet Gallery. It allows you to keep track of all Office 365 auditing information to your local server for as long as it’s required.

You can know more about the announcement in Microsoft Tech Community.