How Long Are Risky User Activity Logs Retained in Entra?
Manage risk by using Microsoft Entra ID Protection
Monitor identity activity by using logs, workbooks, and reports
Answer
Correct answer: C — Microsoft Entra ID Protection retains risky user activity for 90 days, so queries into tenant risk logs reach back a maximum of 90 days.
You have a Microsoft Entra tenant. You need to query risky user activity for the tenant. How long will the logs of risky user activity be retained?
Community Insight
The question tests knowledge of Identity Protection report retention, and the trap is confusing the Risky Users list (no deletion until risk is remediated) with the risky sign-in and risk-detection activity data, which rolls off after 90 days on P2.
Microsoft Entra ID Protection stores risky user activity—risk detections and risky sign-ins queried from the portal and logs—for 90 days on a Premium P2 tenant, which is the retention window the exam expects you to select. This page explains why 90 days (C) is the correct choice and why the 30-day figure learners cite comes from a different, older report description.
Option A (30 days) is the most common wrong pick, because learners quote an older Microsoft Learn sentence stating the risky sign-ins report holds filterable data for up to 30 days, or they apply plain sign-in log retention instead of Identity Protection risk data.
Community Discussion (17 comments)
ppardav
👍 1
Selected: C
https://learn.microsoft.com/en-us/entra/id-protection/concept-risk-reports
levan1988
👍 1
Selected: A
30 days P1 90 days P2
d1e85d9
👍 2
Selected: C
C) confirmed 90 Days Ref Link: https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-investigate-risk#how-to-investigate-risky-users
rvln7
👍 2
Selected: A
This table reflects the latest information on retention periods for Microsoft Entra Free, P1, and P2 as of February 26, 2025. I just had to mark the answer, but as I said...there is no limit for risky users. "Risky users and workload identities are not deleted until the risk has been remediated." ------------------------------------------------- | Feature | Microsoft Entra Free | P1 | P2 | ------------------------------------------------- | Audit Logs | 7 days | 30 days | 30 days | ------------------------------------------------- | Sign-ins | 7 days | 30 days | 30 days | ------------------------------------------------- | Multifactor Authentication Usage | 30 days | 30 days | 30 days | ------------------------------------------------- | Risky Users | No limit | No limit| No limit| ------------------------------------------------- | Risky Sign-ins | 7 days | 30 days | 90 days | -------------------------------------------------
Rahgu
👍 1
Selected: C
It's 90 days, so C.
Btn26
👍 2
Selected: C
Why 90 days is the better answer in this context: The question specifically asks about "risky user activity," implying the use of Identity Protection features. Identity Protection, with its detailed risk assessments and reporting, is a core component of Premium P2. Premium P2 has a 90-day retention for risky sign-ins.
anonymousarpanch
👍 2
sorry, if i understand the question, it is asking for Risky user logs and this URL says 'https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention' that risky users there is 'No Limit'. am i not correctly understanding this?
Phax
👍 2
90 days, logs of risky user activity are usually retained for 90 days...
murcao
👍 2
The question is not well done, but considering the maximum time is 90 days (Entra P2) I will select the option C > Microsoft Entra ID Free : 7 days > Microsoft Entra ID P1: 30 days > Microsoft Entra ID P2: 90 days This retention period allows you to monitor and analyze risky user activity over a significant period to ensure security and compliance More information: Audit logs > Microsoft Entra ID Free: Seven days > Microsoft Entra ID P1: Seven days > Microsoft Entra ID P2: 30 days Sign-ins > Microsoft Entra ID Free: 30 days > Microsoft Entra ID P1: 30 days > Microsoft Entra ID P2: 30 days Microsoft Entra multifactor authentication usage > Microsoft Entra ID Free: 30 days > Microsoft Entra ID P1: 30 days > Microsoft Entra ID P2: 30 days Based on the link below: https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention
Nail
👍 6
Selected: C
I'm going with 90. I'm in the portal right now under Identity Protection, Report, Risky Users and I can go back a maximum of 90 days. Almost all of the other questions seem to assume you have P2.
Tony416
👍 3
Selected: A
This is a tip found in the MS Book SC-300 Exam Prep: The risk reports have different log-rotation periods. The Risky Users report tracks risky users since the beginning of time (from the perspective of tenant inception). The Risky Sign-in report tracks with the log rotation period of the sign-in logs (30 days). The Risk Detections report has a log-rotation period of 90 days.
Tony416
👍 1
Selected: D
This question is entirely nonsensical. I found 90 days. There's no reference to 30 days, even though the log time can be changed. https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-investigate-risk#how-to-investigate-risky-users "When administrators select an individual user, the Risky user details pane appears. Risky user details provide information like: user ID, office location, recent risky sign-in, detections not linked to a sign, and risk history. The Risk history tab shows the events that led to a user risk change in the last 90 days."
jarattdavis
👍 1
Answer is 90 days. The Risk history tab also shows all the events that led to a user risk change in the last 90 days. This list includes risk detections that increased the user’s risk and admin remediation actions that lowered the user’s risk. Note: Question is not referring to Sign in risk which is 30 days. https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-investigate-risk#:~:text=The%20Risk%20history%20tab%20also%20shows%20all%20the%20events%20that%20led%20to%20a%20user%20risk%20change%20in%20the%20last%2090%20days
Sozo
👍 2
Selected: A
The retention period for logs of risky user activity in Microsoft Entra varies by report type and license type. For instance, the risky sign-ins report contains filterable data for up to the past 30 days. However, you can retain the audit and sign-in activity data for longer than the default retention period by routing it to an Azure storage account using Azure Monitor.
baz
👍 4
A. The risky sign-ins report contains filterable data for up to the past 30 days (one month) https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-investigate-risk#risky-users-report
throwaway10188
👍 3
This question is trash. No license specified and even if it did Risky User 'Activity' is retained until the end of time/resolved.
throwaway10188
👍 4
https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention Risky users No limit No limit No limit Risky sign-ins 7 days 30 days 90 days Note Risky users and workload identities are not deleted until the risk has been remediated.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Identity Protection risk reporting is a Premium P2 capability, and the Entra reports data-retention reference lists risky sign-in data at 90 days for P2 tenants, with risk detections following the same 90-day rotation. As Nail observed directly in the portal under Identity Protection > Reports > Risky Users, the date filter will not go back further than 90 days. When a question asks how far back you can query risky user activity in the tenant logs, it is asking for that report window, so 90 days is the defensible answer. The exam convention throughout this set also assumes P2 licensing, which locks in the 90-day figure.Why the Other Options Are Wrong
Option A (30 days) reflects the plain Entra sign-in log retention and an older wording of the investigate-risky-users page; it describes a different data set than Identity Protection risk activity. Options B (60 days) and D (180 days) appear in no Microsoft Entra retention documentation at all, so neither can be justified. The one genuine complication is that the Risky Users report itself is not time-bounded—Microsoft states risky users and workload identities are not deleted until the risk has been remediated—but no option says "until remediated," so the exam is clearly targeting the 90-day activity window. Choosing 30 days therefore credits the wrong table row for a P2 tenant.Community Comment Notes
The thread is split, with Nail, d1e85d9, Btn26 and Phax arguing for 90 days, and Nail grounding it in a live portal check of the Identity Protection report. On the other side, baz quotes the Learn text that "The risky sign-ins report contains filterable data for up to the past 30 days" while rvln7 concedes they "just had to mark the answer" despite the table reading "there is no limit for risky users." throwaway10188 pasted the official retention table showing Risky users as "No limit" across Free, P1 and P2 but Risky sign-ins as 7/30/90 days, and separately complained that "No license specified" makes the item ambiguous. Tony416's book-derived tip likewise separates the reports: risky users since tenant inception, risky sign-ins at 30 days, risk detections at 90 days.Official Reference
Exam Strategy
On SC-300 retention questions, first identify which report is meant—Risky Users, risky sign-ins, or risk detections—because each has a different window. If the scenario implies Identity Protection and gives no license detail, assume Premium P2 and its 90-day activity window.
Frequently Asked Questions
Why is 90 days correct when the Risky Users report says "No limit" for risky users?
The Risky Users list keeps a user until the risk is remediated, but the underlying risky sign-in and risk-detection activity you query rotates off after 90 days on P2. No option says "until remediated," so 90 days is the intended answer.
Why is 30 days wrong for risky sign-in data in Entra?
30 days is the plain sign-in log retention and older documentation wording; the current retention reference lists risky sign-ins at 90 days for Microsoft Entra P2, which is the license Identity Protection requires.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →