Data retention information for Microsoft Defender for Office 365

• Applies to:

  ✅ Exchange Online Protection, ✅ Microsoft Defender for Office 365 Plan 1 and Plan 2

By default, data across different features is retained for a maximum of 30 days. However, for some of the features, you can specify the retention period based on policy. See the following table for the different retention periods for each feature.

Note

Microsoft Defender for Office 365 comes in two different subscriptions: Plan 1 and Plan 2. If you have Threat Explorer at https://security.microsoft.com/threatexplorer, you have Plan 2. Otherwise, you have Real-time Detections at https://security.microsoft.com/realtimereports as part of Plan 1.

Your Defender for Office 365 subscription affects the tools that are available to you, so make sure you know which subscription you have as you learn.

Defender for Office 365 Plan 1

Feature	Retention period
Alert metadata details (Defender for Office 365 alerts)	90 days.
Entity metadata details (Email)	30 days.
Activity alert details (audit logs)	7 days.
Email entity page	30 days.
Quarantine	30 days (configurable; 30 days is the maximum).
Reports	90 days for aggregated data. 30 days for detailed information.
Submissions	30 days.
Real-Time detections	30 days.

Defender for Office 365 Plan 2

Defender for Office 365 Plan 1 capabilities, plus:

Feature	Retention period
Action Center	180 days. Office Action Center 30 days.
Advanced Hunting	30 days.
AIR (Automated investigation and response)	60 days for investigations metadata. 30 days for email metadata.
Attack simulation training data	18 months.
Campaigns	30 days.
Incidents	30 days.
Remediation	30 days
Threat Analytics	30 days.
Threat Explorer	30 days.
Threat Trackers	30 days.