How long does Azure AD store the Audit and Sign-ins events data?

Activity reports

Report	Azure AD Free	Azure AD Basic	Azure AD Premium P1	Azure AD Premium P2
Audit logs	7 days	7 days	30 days	30 days
Sign-ins	N/A	N/A	30 days	30 days
Azure MFA usage	30 days	30 days	30 days	30 days

You can retain the audit and sign-in activity data for longer than the default retention period outlined above by routing it to an Azure storage account using Azure Monitor. For more information, see Archive Azure AD logs to an Azure storage account.

Security signals

Report	Azure AD Free	Azure AD Basic	Azure AD Premium P1	Azure AD Premium P2
Users at risk	7 days	7 days	30 days	90 days
Risky sign-ins	7 days	7 days	30 days	90 days

Source URL: https://docs.microsoft.com/en-gb/azure/active-directory/reports-monitoring/reference-reports-data-retention