What retention period should you set for the AzureActivity table?
You have a Microsoft Sentinel workspace named Workspace1 that contains the AzureActivity table. You need to configure the retention period for the AzureActivity table. The solution must meet the following requirements: • Maximize the period during which you can run interactive queries. • Minimize retention costs. To what should you set the retention period? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Community Insight
The exam tests the trade-off between interactive retention and cost for AzureActivity, and the trap is choosing 30 days as the cheap default or 2 years as the literal maximum.
This SC-200 item tests how to set Microsoft Sentinel table retention for the AzureActivity table so that interactive queries stay available as long as possible without adding retention cost. The correct setting is 90 days, the free Azure Activity log retention boundary.
Many learners pick 30 days because it is the Log Analytics default, but that leaves the free 90-day Azure Activity retention window unused and shortens interactive query access.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The AzureActivity table is populated by the Azure Activity connector, and Azure Activity log data has a 90-day retention window at no extra retention charge. Setting the table's interactive retention to 90 days therefore keeps the longest period in which analysts can run interactive KQL queries without paying for extended retention. A 30-day setting would leave 60 free days unused and reduce the interactive query window, while 180 days or 2 years crosses into billable retention and fails the cost-minimization requirement. The requirement pair maximize interactive queries and minimize retention costs is designed to point at the 90-day free boundary, not at the workspace maximum.Why the Other Options Are Wrong
A 30-day setting is the default minimum and does not maximize interactive query access when 90 days is available at the same cost. A 180-day setting extends beyond the 90-day free window and incurs retention charges for AzureActivity data. A 2-year setting is the maximum interactive retention but is expensive and directly violates the requirement to minimize retention costs. None of these options satisfies both stated requirements as cleanly as 90 days.Community Comment Notes
Mebyxu supports 90 days and notes that "Azure retains activity log events for 90 days", linking to the Microsoft Learn activity log documentation. That aligns with the exam doctrine that Azure Activity log data has a 90-day retention boundary. No commenter provides a credible counterargument for 30 days, 180 days, or 2 years.Official Reference
Exam Strategy
When an SC-200 retention item asks to maximize interactive queries and minimize cost, look for the free retention boundary of the specific table or data source; for AzureActivity that boundary is 90 days. Do not pick the maximum 730-day interactive retention just because the stem says maximize, because the cost constraint is equally weighted.
Frequently Asked Questions
Why not set AzureActivity retention to 30 days to save costs?
30 days is the default but does not maximize interactive queries; Azure Activity data is free to retain for 90 days, so 90 days gives more query time at no extra retention cost.
What happens to AzureActivity data after 90 days?
It is deleted unless you extend retention or use long-term retention, which adds cost and is not needed to meet the minimize-cost requirement.
Related Analysis
Practice All SC-200 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-200 Practice Test →