Get-UnifiedAuditLogRetentionPolicy
This cmdlet is available only in Security & Compliance PowerShell. For more information, see Security & Compliance PowerShell.
Use the Get-UnifiedAuditLogRetentionPolicy cmdlet to view the properties of the audit log retention policies in the Microsoft Defender portal or the Microsoft Purview compliance portal.
For information about the parameter sets in the Syntax section below, see Exchange cmdlet syntax.
Syntax
Default (Default)
Get-UnifiedAuditLogRetentionPolicy
[-Operation <String>]
[-RecordType <AuditRecordType>]
[-RetentionDuration <UnifiedAuditLogRetentionDuration>]
[-UserId <String>]
[<CommonParameters>]
Description
Audit log retention policies are used to specify a retention duration for audit logs for that are generated by admin and user activity. An audit log retention policy can specify the retention duration based on the type of audited activities, the Microsoft 365 service that activities are performed in, or the users who performed the activities. For more information, see Manage audit log retention policies.
To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see Permissions in the Microsoft Defender portal or Permissions in the Microsoft Purview compliance portal.
Examples
Example 1
Get-UnifiedAuditLogRetentionPolicy | Sort-Object -Property Priority | Format-List Priority,Name,Description,RecordTypes,Operations,UserIds,RetentionDuration
This example lists the configurable properties for all audit log retention policies in your organization. The command also lists the policies in order of highest to lowest priority.
Example 2
Get-UnifiedAuditLogRetentionPolicy -RecordType ExchangeItem | Format-List Name,Description,RecordTypes,Operations,UserIds,RetentionDuration,Priority
This example lists the configurable properties for all audit log retention policies that apply to audit records the record type of ExchangeItem.
Parameters
-Operation
Applicable: Security & Compliance
The Operations parameter filters the results by the operations that are specified in the policy. For a list of the available values for this parameter, see Audited activities.
You can enter multiple values separated by commas. If the values contain spaces or otherwise require quotation marks, use the following syntax: "Value1","Value2",..."ValueN".
Parameter properties
| Type: | String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-RecordType
Applicable: Security & Compliance
The RecordType parameter filters the results by the record types that are defined in the policy. For details about the available values, see AuditLogRecordType.
Parameter properties
| Type: | AuditRecordType |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-RetentionDuration
Applicable: Security & Compliance
The RetentionDuration parameter filters the policy results by the retention duration specified in the policy. Valid values are:
- ThreeMonths
- SixMonths
- NineMonths
- TwelveMonths
- TenYears
Parameter properties
| Type: | UnifiedAuditLogRetentionDuration |
| Default value: | None |
| Accepted values: | ThreeMonths, SixMonths, NineMonths, TwelveMonths, TenYears |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-UserId
Applicable: Security & Compliance
The UserIds parameter filters the policy results by the ID of the users who are specified in the policy.
You can enter multiple values separated by commas. If the values contain spaces or otherwise require quotation marks, use the following syntax: "Value1","Value2",..."ValueN".
Parameter properties
| Type: | String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.