New-UnifiedAuditLogRetentionPolicy

This cmdlet is available only in Office 365 Security & Compliance Center PowerShell. For more information, see Office 365 Security & Compliance Center PowerShell (https://docs.microsoft.com/powershell/exchange/office-365-scc/office-365-scc-powershell).

Use the New-UnifiedAuditLogRetentionPolicy cmdlet to create audit log retention policies in the Office 365 Security & Compliance Center.

For information about the parameter sets in the Syntax section below, see Exchange cmdlet syntax (https://docs.microsoft.com/powershell/exchange/exchange-server/exchange-cmdlet-syntax).

Syntax

New-UnifiedAuditLogRetentionPolicy
   [-Name] <String>
   -Priority <Int32>
   -RetentionDuration <UnifiedAuditLogRetentionDuration>
   [-Confirm]
   [-Description <String>]
   [-Operations <MultiValuedProperty>]
   [-RecordTypes <MultiValuedProperty>]
   [-UserIds <MultiValuedProperty>]
   [-WhatIf]
   [<CommonParameters>]

Description

Audit log retention policies are used to specify a retention duration for audit logs for that are generated by admin and user activity. An audit log retention policy can specify the retention duration based on the type of audited activities, the Office 365 service that activities are performed in, or the users who performed the activities. For more information, see Manage audit log retention policies.

You need to be assigned permissions in the Office 365 Security & Compliance Center before you can use this cmdlet. For more information, see Permissions in Office 365 Security & Compliance Center.

Examples

Example 1

New-UnifiedAuditLogRetentionPolicy -Name "Microsoft Teams Audit Policy" -Description "One year retention policy for all Microsoft Teams activities" -RecordTypes MicrosoftTeams -RetentionDuration TwelveMonths -Priority 100

This example creates an audit log retention policy that retains all audit logs related to Microsoft Teams events for one year.

Example 2

New-UnifiedAuditLogRetentionPolicy -Name "SearchQueryPerformed by app@sharepoint" -Description "90 day retention policy for noisy SharePoint events" -RecordTypes SharePoint  -Operations SearchQueryPerformed -UserIds "app@sharepoint" -RetentionDuration ThreeMonths -Priority 10000

This example creates an audit log retention policy that retains all audit logs for the SearchQueryPerformed activity performed by the app@sharepoint service account for 90 days.

Parameters

-Confirm

The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on if the cmdlet requires confirmation before proceeding.

  • Destructive cmdlets (for example, Remove-* cmdlets) have a built-in pause that forces you to acknowledge the command before proceeding. For these cmdlets, you can skip the confirmation prompt by using this exact syntax: -Confirm:$false.

  • Most other cmdlets (for example, New-* and Set-* cmdlets) don't have a built-in pause. For these cmdlets, specifying the Confirm switch without a value introduces a pause that forces you acknowledge the command before proceeding.

Type:SwitchParameter
Aliases:cf
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Office 365 Security & Compliance Center
-Description

The Description parameter specifies a description for the audit log retention policy. The maximum length is 256 characters. If the value contains spaces, enclose the value in quotation marks (").

Type:String
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Office 365 Security & Compliance Center
-Name

The Name parameter specifies a unique name for the audit log retention policy. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks (").

Type:String
Position:0
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Office 365 Security & Compliance Center
-Operations

The Operations parameter specifies the audit log operations that are retained by the policy. For a list of the available values for this parameter, see Audited activities.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

If you use this parameter, you must also use the RecordTypes parameter to specify the record type. You can't use this parameter if you've specified more than one value for the RecordTypes parameter.

Type:MultiValuedProperty
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Office 365 Security & Compliance Center
-Priority

The Priority parameter specifies a priority value for the policy that determines the order of policy processing. A higher integer value indicates a higher priority, the value 10000 is the highest priority, and policies can't have the same priority value.

Valid values and the default value for this parameter depend on the number of existing policies. For example, if there are 8 existing policies:

  • Valid priority values for the existing 8 policies are from 7 through 0.

  • Valid priority values for a new policy (the 9th policy) are from 8 through 0.

You must use a unique priority value when creating new audit log retention policies. Any custom audit log retention policy that you create will take precedence over the default audit log retention policy. For more information, see Advanced audit in Microsoft 365.

Type:Int32
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Office 365 Security & Compliance Center
-RecordTypes

The RecordTypes parameter specifies the audit logs of a specific record type that are retained by the policy. You can specify multiple values separated by commas. If you specify more than one value, you can't use the Operations parameter. Valid values are:

  • AeD

  • AirInvestigation

  • ApplicationAudit

  • AzureActiveDirectory

  • AzureActiveDirectoryAccountLogon

  • AzureActiveDirectoryStsLogon

  • CRM

  • Campaign

  • ComplianceDLPExchange

  • ComplianceDLPSharePoint

  • ComplianceDLPSharePointClassification

  • ComplianceSupervisionExchange

  • CustomerKeyServiceEncryption

  • DLPEndpoint

  • DataCenterSecurityCmdlet

  • DataGovernance

  • DataInsightsRestApiAudit

  • Discovery

  • ExchangeAdmin

  • ExchangeAggregatedOperation

  • ExchangeItem

  • ExchangeItemAggregated

  • ExchangeItemGroup

  • HRSignal

  • HygieneEvent

  • InformationBarrierPolicyApplication

  • InformationWorkerProtection

  • Kaizala

  • LabelExplorer

  • MIPLabel

  • MailSubmission

  • MicrosoftFlow

  • MicrosoftForms

  • MicrosoftStream

  • MicrosoftTeams

  • MicrosoftTeamsAdmin

  • MicrosoftTeamsAnalytics

  • MicrosoftTeamsDevice

  • MicrosoftTeamsShifts

  • MipAutoLabelExchangeItem

  • MipAutoLabelSharePointItem

  • MipAutoLabelSharePointPolicyLocation

  • OfficeNative

  • OneDrive

  • PowerAppsApp

  • PowerAppsPlan

  • PowerBIAudit

  • Project

  • Quarantine

  • SecurityComplianceAlerts

  • SecurityComplianceCenterEOPCmdlet

  • SecurityComplianceInsights

  • SharePoint

  • SharePointCommentOperation

  • SharePointContentTypeOperation

  • SharePointFieldOperation

  • SharePointFileOperation

  • SharePointListItemOperation

  • SharePointListOperation

  • SharePointSharingOperation

  • SkypeForBusinessCmdlets

  • SkypeForBusinessPSTNUsage

  • SkypeForBusinessUsersBlocked

  • Sway

  • SyntheticProbe

  • TeamsHealthcare

  • ThreatFinder

  • ThreatIntelligence

  • ThreatIntelligenceAtpContent

  • ThreatIntelligenceUrl

  • WorkplaceAnalytics

  • Yammer

Type:MultiValuedProperty
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Office 365 Security & Compliance Center
-RetentionDuration

The RetentionDuration parameter specifies how long audit log records are kept. Valid values are:

  • ThreeMonths

  • SixMonths

  • NineMonths

  • TwelveMonths

Type:UnifiedAuditLogRetentionDuration
Accepted values:ThreeMonths, SixMonths, NineMonths, TwelveMonths
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Office 365 Security & Compliance Center
-UserIds

The UserIds parameter specifies the audit logs that are retained by the policy based on the ID of the user who performed the action.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

Type:MultiValuedProperty
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Office 365 Security & Compliance Center
-WhatIf

The WhatIf switch doesn't work in Office 365 Security & Compliance Center PowerShell.

Type:SwitchParameter
Aliases:wi
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Office 365 Security & Compliance Center

Inputs

Outputs