Unified audit log tier you get by default, keeping records for 180 days; custom retention policies and intelligent insights aren't included.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Microsoft Purview Audit (Standard) in context, with comparison tables and the common traps.
Terms in this definition
- Unified audit log
A record of what users and administrators do across numerous Microsoft 365 services, which can be searched with Microsoft Purview Audit. For core services, entries typically become available between one hour and an hour and a half after the activity.
- Archive
Offline access tier for blobs, cheapest to store yet dearest to access. Reading a blob means rehydrating it first, which can take as long as 15 hours.
- Get
Key Vault permission on secrets that allows a single secret to be read; App Service Key Vault references need nothing beyond it.
- Intelligent insights
Extra-valuable audit records that Microsoft Purview Audit (Premium) captures to support forensic and compliance investigations into a possible breach, for example around access to mail items.