Retain Audit Logs for 10 Years in Microsoft 365 E5

SC-400 By islever Editorial Last updated Sep 23, 2026

Short answer

D Assign a 10-year audit log retention add-on license to User1.

Question

You have a Microsoft 365 E5 subscription that contains two users named User1 and Admin1. Admin1 manages audit retention policies for the subscription. You need to ensure that the audit logs of User1 will be retained for 10 years. What should you do first?

Assign a Microsoft Purview Audit (Premium) add-on license to User1.
Assign a 10-year audit log retention add-on license to Admin1.
Assign a Microsoft Purview Audit (Premium) add-on license to Admin1.
Assign a 10-year audit log retention add-on license to User1. Correct Answer

Key Takeaways

The key trap is assigning the license to the administrator instead of the target user; extended retention licenses are per-user and apply only to the mailbox or account they are assigned to.

To retain audit logs for a specific user beyond the default period in Microsoft 365, you must assign the 10-year audit log retention add-on license directly to that user. This question tests your understanding of licensing requirements for extended audit retention policies.

Common mistake: Candidates often choose option C (assigning to Admin1) because they mistakenly believe the administrator needs the license to manage or enable the retention policy, rather than realizing it is required on the subject's account.

Expert Analysis

Why the Answer Is Correct

Correct answer: D — Assign a 10-year audit log retention add-on license to User1. According to Microsoft documentation, retaining audit logs for longer than 90 days requires an additional license. Specifically, to achieve a 10-year retention period, you must purchase and assign the 'Audit Log Retention Add-on' license to each individual user whose logs you wish to retain for that duration. Since the goal is to retain User1's logs, the license must be applied to User1.

Why the Other Options Are Wrong

Option A is incorrect because the Microsoft Purview Audit (Premium) add-on extends search capabilities and retention to 1 year, not 10 years. Options B and C are incorrect because the license is not tied to the administrator managing the policy; it is tied to the data source (the user). Assigning it to Admin1 would only extend retention for Admin1’s own activities, leaving User1’s logs at the standard 90-day limit.

Community Comment Notes

Community consensus strongly supports Option D. Users emphasize that the license is per-user and must be assigned to the entity being monitored, as noted by commenters who stated, "Add-on license needs to be assigned to User1, not Admin1." Official Microsoft documentation links provided in comments confirm this per-user licensing model.

Official Reference

https://learn.microsoft.com/en-us/purview/audit-log-retention-policies?tabs=microsoft-purview-portal#before-you-create-an-audit-log-retention-policy

This link opens the official vendor documentation in a new tab.

Exam Strategy

When dealing with Microsoft 365 compliance and governance questions, always identify whether the requirement applies to the administrator or the data owner/user. For retention and eDiscovery licenses, read carefully to see if the scope is 'all users' or 'specific users'. If it is specific, the license assignment step must target those specific accounts.

Frequently Asked Questions

Does the admin need the 10-year license to create the policy?

No. The admin needs appropriate permissions (like Compliance Administrator), but the 10-year license is only required on the user accounts whose logs are being retained.

What does Audit (Premium) add-on provide?

It provides advanced search capabilities and extends retention up to 1 year, but it does not support the 10-year retention period which requires the separate add-on license.

More SC-400 FAQ →

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

Domza 👍 5

Important: Retaining audit logs for 10 years requires an extra per-user add-on license. After this license is assigned to a user and an appropriate 10-year audit log retention policy is set for that user, audit logs covered by that policy will start to be retained for the 10-year period
sswitzer 👍 2 Answered D

chatgpt: The correct option to ensure that the audit logs of User1 will be retained for 10 years is: D. Assign a 10-year audit log retention add-on license to User1. Assigning an audit log retention add-on license to the user for whom you want to retain the audit logs is the appropriate action. This allows you to set a specific retention period for that user's audit logs. In this case, you want to assign the 10-year audit log retention add-on license to User1 to meet the requirement of retaining User1's audit logs for 10 years.
thetootall 👍 2 Answered D

Read the question carefully..... we need to assign the license to the user whose logs we need to retain, not the admin who is enabling it. D is correct
CharlieGolf 👍 2 Answered D

Add-on license needs to be assigned to User1, not Admin1.
JimboJones99 👍 1 Answered D

The 10-year add-on licence needs to be added to the user: https://learn.microsoft.com/en-us/purview/audit-log-retention-policies?view=o365-worldwide&tabs=microsoft-purview-portal#create-an-audit-log-retention-policy

Show 1 more comment

MKnight25 👍 1 Answered D

D is correct based on the MS documentation https://learn.microsoft.com/en-us/purview/audit-log-retention-policies?tabs=microsoft-purview-portal#before-you-create-an-audit-log-retention-policy

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

← Back to SC-400 Study Guide