What retention period should you set for the AzureActivity table?

SC-200 By islever Editorial Last updated

Configure the Microsoft Sentinel SIEM and platform

Short answer

B Set the AzureActivity table retention to 90 days to keep interactive query access for the free activity-log retention window while avoiding extra retention costs.

Question

You have a Microsoft Sentinel workspace named Workspace1 that contains the AzureActivity table.
You need to configure the retention period for the AzureActivity table. The solution must meet the following requirements:
• Maximize the period during which you can run interactive queries.
• Minimize retention costs.
To what should you set the retention period? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
  1. 30 days
  2. 90 days Correct Answer
  3. 180 days
  4. 2 years

Key Takeaways

The exam tests the trade-off between interactive retention and cost for AzureActivity, and the trap is choosing 30 days as the cheap default or 2 years as the literal maximum.

This SC-200 item tests how to set Microsoft Sentinel table retention for the AzureActivity table so that interactive queries stay available as long as possible without adding retention cost. The correct setting is 90 days, the free Azure Activity log retention boundary.

Common mistake: Many learners pick 30 days because it is the Log Analytics default, but that leaves the free 90-day Azure Activity retention window unused and shortens interactive query access.

Expert Analysis

Why the Answer Is Correct

The AzureActivity table is populated by the Azure Activity connector, and Azure Activity log data has a 90-day retention window at no extra retention charge. Setting the table's interactive retention to 90 days therefore keeps the longest period in which analysts can run interactive KQL queries without paying for extended retention. A 30-day setting would leave 60 free days unused and reduce the interactive query window, while 180 days or 2 years crosses into billable retention and fails the cost-minimization requirement. The requirement pair maximize interactive queries and minimize retention costs is designed to point at the 90-day free boundary, not at the workspace maximum.

Why the Other Options Are Wrong

A 30-day setting is the default minimum and does not maximize interactive query access when 90 days is available at the same cost. A 180-day setting extends beyond the 90-day free window and incurs retention charges for AzureActivity data. A 2-year setting is the maximum interactive retention but is expensive and directly violates the requirement to minimize retention costs. None of these options satisfies both stated requirements as cleanly as 90 days.

Community Comment Notes

Mebyxu supports 90 days and notes that "Azure retains activity log events for 90 days", linking to the Microsoft Learn activity log documentation. That aligns with the exam doctrine that Azure Activity log data has a 90-day retention boundary. No commenter provides a credible counterargument for 30 days, 180 days, or 2 years.

Official Reference

https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log

This link opens the official vendor documentation in a new tab.

Exam Strategy

When an SC-200 retention item asks to maximize interactive queries and minimize cost, look for the free retention boundary of the specific table or data source; for AzureActivity that boundary is 90 days. Do not pick the maximum 730-day interactive retention just because the stem says maximize, because the cost constraint is equally weighted.

Frequently Asked Questions

Why not set AzureActivity retention to 30 days to save costs?

30 days is the default but does not maximize interactive queries; Azure Activity data is free to retain for 90 days, so 90 days gives more query time at no extra retention cost.

What happens to AzureActivity data after 90 days?

It is deleted unless you extend retention or use long-term retention, which adds cost and is not needed to meet the minimize-cost requirement.

More SC-200 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. Mebyxu 👍 1 Answered B
    Retention period Azure retains activity log events for 90 days and then deletes them. https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log?utm_source=chatgpt.com&tabs=portal-1%2Clog-analytics%2Cportal-2

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide