Retrieve Sign in Data greater than 7 days

Krissy Huxley 1 Reputation point
2020-11-25T06:07:49.07+00:00

Hello, I recently found out that someone was accessing my email and was changing incoming and outgoing attachments. I want to find out how long this has been going on for, and searched the Sign in Report in Azure AD to find that data can be retrieved for up to the last 7 days. I upgraded from free subscription to P2 and although it now says I can get 30 days of data I still cant get more that previous 7 days. I have tried looking at logs and they are the same 7 days. Are there any other alternatives?
Thanks in advanced

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,471 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. soumi-MSFT 11,716 Reputation points Microsoft Employee
    2020-11-25T06:37:35.137+00:00

    Hello @Krissy Huxley , thank you for reaching out. You can only get logs for 30 days as the retention period for these logs by AAD is for 30 days. After 30 days, all signing and audit logs are flushed out. You are not able to view the previous logs even after you upgraded to the AAD P2 license is because your old logs (older than 30 days), while you were in the free license, have already got wiped out. The only available logs available now are of the past 7 days and these logs would be there for the next 23 days and then these would also get flushed out. After the upgrade to P1 or P2 license, it usually takes 48 to 72 hrs for the logs to re-populate (if not already removed from our backend)

    You can find the same query being answered here: https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-reports-data-retention#how-soon-can-i-see-activities-data-after-getting-a-premium-license

    If logs are permanently deleted unfortunately there is no way to recover them. But henceforth if you would like to keep monitoring your signin-activity or audit-logs, I would recommend you to please backup your signin and audit logs periodically, by manual or automated means, and store it with yourself.

    Hope this helps.

    Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as an Answer; if the above response helped in answering your query.