How to Retrieve Azure Sign-In Logs Older Than Two Months
Question details
The user needs to recover Microsoft Entra ID (formerly Azure AD) sign-in logs that are older than two months, which are no longer visible in the default Azure portal.
- Product
- Microsoft Azure
- Device & OS
- not provided
- Scenario
- Performing an audit or security investigation that requires historical account sign-in data beyond the standard 30-day retention period.
- Observed behavior
- Logs older than the configured retention period (typically 30 days) are missing from the Azure portal and cannot normally be retrieved unless previously archived.
Verify your Microsoft Entra ID premium license tier, as default retention limits vary by plan, and confirm you have the necessary administrative privileges to view diagnostic settings or external storage accounts.
Retrieve Historical Logs from Configured Archives
Check if your organization previously set up diagnostic settings to route sign-in logs to a long-term retention destination.
The Azure portal natively stores sign-in logs for a limited time (typically 30 days for Premium tenants). Logs older than this are permanently purged from the main interface. However, they can still be retrieved if your environment was previously configured to export them.
Navigate to your Azure Portal, search for 'Log Analytics workspaces', select the workspace associated with your Entra ID, and use Kusto Query Language (KQL) under the 'Logs' tab to query the SigninLogs table.
If logs were archived to a storage account instead, search for 'Storage accounts' in the portal, access the designated account, and navigate to the 'Containers' section. Look for containers named 'insights-logs-signinlogs' to download the historical JSON data.
Verify if your organization forwards logs to an Event Hub for ingestion into an external Security Information and Event Management (SIEM) system (like Splunk or QRadar), where older records might be retained.
Configure Diagnostic Settings for Future Retention
Set up automated log exports now to ensure you can retain and access future sign-in logs for more than two months.
Analyze Exported Cloud Audit Logs with WPS Office
While Azure handles your cloud infrastructure and log retention, analyzing exported JSON or CSV log files often requires a powerful spreadsheet tool. WPS Office is a lightweight, high-performance suite that easily opens large log exports, formats audit reports, and serves as a completely free alternative to Microsoft Office.
- 1. Download the Log File: Export your Azure sign-in logs as a CSV file from the Azure portal or your connected Storage Account.
- 2. Open in WPS Spreadsheet: Launch WPS Office, select Spreadsheet, and open your downloaded CSV file to parse the log data automatically.
- 3. Filter and Analyze: Use built-in data filtering and pivot tables in WPS Spreadsheet to quickly isolate specific user sign-ins, IP addresses, or date ranges from the exported dataset.
Frequently Asked Questions
What is the default retention period for Azure sign-in logs?
For Microsoft Entra ID Free tenants, sign-in logs are retained for 7 days. For Premium P1 and P2 license tiers, the default retention period in the portal is 30 days.
Can Microsoft support recover deleted or expired Azure logs?
No. Once sign-in logs pass the standard retention period and are purged from the system, they are permanently deleted. Microsoft support cannot restore them unless you previously configured an export to a Storage Account or Log Analytics workspace.
Which export destination is best for long-term Azure log retention?
An Azure Storage Account is generally the most cost-effective option for long-term archival. However, if you need to actively query, alert, or visualize the logs, a Log Analytics Workspace is highly recommended despite its slightly higher retention costs.
