Retain Audit Logs for 10 Years in Microsoft 365 E5
You have a Microsoft 365 E5 subscription that contains two users named User1 and Admin1. Admin1 manages audit retention policies for the subscription. You need to ensure that the audit logs of User1 will be retained for 10 years. What should you do first?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The key trap is assigning the license to the administrator instead of the target user; extended retention licenses are per-user and apply only to the mailbox or account they are assigned to.
To retain audit logs for a specific user beyond the default period in Microsoft 365, you must assign the 10-year audit log retention add-on license directly to that user. This question tests your understanding of licensing requirements for extended audit retention policies.
Candidates often choose option C (assigning to Admin1) because they mistakenly believe the administrator needs the license to manage or enable the retention policy, rather than realizing it is required on the subject's account.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Correct answer: D — Assign a 10-year audit log retention add-on license to User1. According to Microsoft documentation, retaining audit logs for longer than 90 days requires an additional license. Specifically, to achieve a 10-year retention period, you must purchase and assign the 'Audit Log Retention Add-on' license to each individual user whose logs you wish to retain for that duration. Since the goal is to retain User1's logs, the license must be applied to User1.Why the Other Options Are Wrong
Option A is incorrect because the Microsoft Purview Audit (Premium) add-on extends search capabilities and retention to 1 year, not 10 years. Options B and C are incorrect because the license is not tied to the administrator managing the policy; it is tied to the data source (the user). Assigning it to Admin1 would only extend retention for Admin1’s own activities, leaving User1’s logs at the standard 90-day limit.Community Comment Notes
Community consensus strongly supports Option D. Users emphasize that the license is per-user and must be assigned to the entity being monitored, as noted by commenters who stated, "Add-on license needs to be assigned to User1, not Admin1." Official Microsoft documentation links provided in comments confirm this per-user licensing model.Official Reference
Exam Strategy
When dealing with Microsoft 365 compliance and governance questions, always identify whether the requirement applies to the administrator or the data owner/user. For retention and eDiscovery licenses, read carefully to see if the scope is 'all users' or 'specific users'. If it is specific, the license assignment step must target those specific accounts.
Frequently Asked Questions
Does the admin need the 10-year license to create the policy?
No. The admin needs appropriate permissions (like Compliance Administrator), but the 10-year license is only required on the user accounts whose logs are being retained.
What does Audit (Premium) add-on provide?
It provides advanced search capabilities and extends retention up to 1 year, but it does not support the 10-year retention period which requires the separate add-on license.