Hello, and welcome to audit log retention! 

Audit log retention policies are used to specify how long audit logs in your organization should be retained. They are part of the Advanced Audit capabilities that Microsoft 365 offers, and they are created and managed using the Security & Compliance Center.

Audit logs can be retained for up to 10 years, and the audit log policies you create can be based on a few different criteria. For example, you can create audit log policies that are based on the Microsoft 365 activities for a specific user, or based on Microsoft 365 activities for all users. Priority levels can be used to determine which policy takes precedence in cases where you have multiple policies in place.

While you can configure custom audit log retention policies to fit your needs, the Microsoft 365 Advanced Audit feature provides a default audit log retention policy right out of the box. This default audit log policy, which cannot be modified, retains all Exchange data, all SharePoint data, and all Azure Active Directory audit records for a year. 

I should mention, however, that the default audit log retention policy only applies to the audit records for users who have been assigned an Office 365 license, a Microsoft 365 E5 license, a Microsoft 365 E5 Compliance license, or an E5 eDiscovery and Audit add-on license. Audit records for guest users and users without an E5 license are retained for 90 days.

Before you can create or modify audit retention policies, you need to have been assigned the Organization Configuration role in the Security & Compliance Center. It’s also important to note that the max number of audit log retention policies that is allowed within an organization is 50.

It’s also important to remember that a custom audit log retention policy will always take precedence over the default retention policy for the organization.