Set-UnifiedAuditLogRetentionPolicy
This cmdlet is available only in Security & Compliance PowerShell. For more information, see Security & Compliance PowerShell.
Use the Set-UnifiedAuditLogRetentionPolicy cmdlet to modify audit log retention policies in the Microsoft Defender portal or the Microsoft Purview compliance portal.
For information about the parameter sets in the Syntax section below, see Exchange cmdlet syntax.
Syntax
Default (Default)
Set-UnifiedAuditLogRetentionPolicy
[-Identity] <PolicyIdParameter>
-Priority <Int32>
-RetentionDuration <UnifiedAuditLogRetentionDuration>
[-Confirm]
[-Description <String>]
[-Operations <MultiValuedProperty>]
[-RecordTypes <MultiValuedProperty>]
[-UserIds <MultiValuedProperty>]
[-WhatIf]
[<CommonParameters>]
Description
Audit log retention policies are used to specify a retention duration for audit logs for that are generated by admin and user activity. An audit log retention policy can specify the retention duration based on the type of audited activities, the Microsoft 365 service that activities are performed in, or the users who performed the activities. For more information, see Manage audit log retention policies.
To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see Permissions in the Microsoft Defender portal or Permissions in the Microsoft Purview compliance portal.
Examples
Example 1
Set-UnifiedAuditLogRetentionPolicy -Identity "eDiscovery audit retention" -RecordTypes Discovery,AeD -UserIds admin@contoso.onmicrosoft.com -RetentionDuration SixMonths -Priority 100
This example adds the AeD (for eDiscovery Premium events) record type to the policy. It also configures that the policy is applied only to the audit logs for activities performed only by the user admin@contoso.onmicrosoft.com.
Example 2
Set-UnifiedAuditLogRetentionPolicy -Name "SearchQueryPerformed by app@sharepoint" -Operations SearchQueryPerformed,FileAccessed -UserIds $null -RetentionDuration SixMonths -Priority 10000
This example modifies an audit log retention policy and changes to retention duration to six months, adds an additional activity to the Operations parameter, and removes all values from the UserId property so the policy applies to all users.
Parameters
-Confirm
Applicable: Security & Compliance
The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on if the cmdlet requires confirmation before proceeding.
- Destructive cmdlets (for example, Remove-* cmdlets) have a built-in pause that forces you to acknowledge the command before proceeding. For these cmdlets, you can skip the confirmation prompt by using this exact syntax:
-Confirm:$false. - Most other cmdlets (for example, New-* and Set-* cmdlets) don't have a built-in pause. For these cmdlets, specifying the Confirm switch without a value introduces a pause that forces you acknowledge the command before proceeding.
Parameter properties
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Aliases: | cf |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-Description
Applicable: Security & Compliance
The Description parameter specifies a description for the audit log retention policy. The maximum length is 256 characters. If the value contains spaces, enclose the value in quotation marks (").
Parameter properties
| Type: | String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-Identity
Applicable: Security & Compliance
The Identity parameter specifies the unified audit log retention policy that you want to modify. You can use any value that uniquely identifies the policy. For example:
- Name
- Distinguished name (DN)
- GUID
Parameter properties
| Type: | PolicyIdParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | 0 |
| Mandatory: | True |
| Value from pipeline: | True |
| Value from pipeline by property name: | True |
| Value from remaining arguments: | False |
-Operations
Applicable: Security & Compliance
The Operations parameter specifies the audit log operations that are retained by the policy. The values you specify overwrite any existing entries. For a list of the available values for this parameter, see Audited activities.
You can enter multiple values separated by commas. If the values contain spaces or otherwise require quotation marks, use the following syntax: "Value1","Value2",..."ValueN".
Parameter properties
| Type: | MultiValuedProperty |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-Priority
Applicable: Security & Compliance
The Priority parameter specifies a priority value for the policy that determines the order of policy processing. A higher integer value indicates a lower priority. The value 1 is the highest priority, and the value 10000 is the lowest priority. No two policies can have the same priority value.
This parameter is required when you modify an audit log retention policy, and you must use a unique priority value.
Parameter properties
| Type: | Int32 |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | True |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-RecordTypes
Applicable: Security & Compliance
The RecordTypes parameter specifies the audit logs of a specific record type that are retained by the policy. For details about the available values, see AuditLogRecordType.
You can specify multiple values separated by commas. The values you specify overwrite any existing entries.
Parameter properties
| Type: | MultiValuedProperty |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-RetentionDuration
Applicable: Security & Compliance
The RetentionDuration parameter specifies how long audit log records are kept. Valid values are:
- ThreeMonths
- SixMonths
- NineMonths
- TwelveMonths
- TenYears
This parameter is required when modifying an audit log retention policy.
Parameter properties
| Type: | UnifiedAuditLogRetentionDuration |
| Default value: | None |
| Accepted values: | ThreeMonths, SixMonths, NineMonths, TwelveMonths, TenYears |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | True |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-UserIds
Applicable: Security & Compliance
The UserIds parameter specifies the audit logs that are retained by the policy based on the ID of the user who performed the action. The values you specify overwrite any existing entries.
You can enter multiple values separated by commas. If the values contain spaces or otherwise require quotation marks, use the following syntax: "Value1","Value2",..."ValueN".
Parameter properties
| Type: | MultiValuedProperty |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-WhatIf
Applicable: Security & Compliance
The WhatIf switch doesn't work in Security & Compliance PowerShell.
Parameter properties
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Aliases: | wi |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.