# Network access logs are retained for security analysis and compliance requirements
Without extended retention for Global Secure Access audit and traffic logs, threat actors can operate beyond the default 30-day retention window, knowing…
Source: https://maester.dev/docs/tests/ZTA.25420
## Overview
Without extended retention for Global Secure Access audit and traffic logs, threat actors can operate beyond the default 30-day retention window, knowing that their activities are automatically purged before detection occurs. Security investigations often require historical analysis spanning weeks or months to identify compromise vectors, lateral movement patterns, and data exfiltration channels.
Without adequate log retention:
- Security teams can't establish baseline behavior patterns, perform retrospective threat hunting, or correlate network access events across extended timeframes.
- Organizations subject to regulatory frameworks like [GDPR](https://learn.microsoft.com/compliance/regulatory/gdpr?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci), HIPAA, PCI DSS, and SOX face compliance violations when they're unable to produce audit trails for mandated retention periods.
- Root cause analysis during incident response is limited, potentially allowing threat actors to maintain persistence while organizations focus on visible symptoms.
## Remediation
- [Configure diagnostic settings with a Log Analytics workspace](https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) for an extended retention of 90-730 days, with query capabilities.
- [Configure Log Analytics workspace retention](https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to meet organizational security and compliance requirements (minimum 90 days recommended).
- [Enable table-level retention](https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#configure-table-level-retention) for specific Global Secure Access tables to extend beyond workspace defaults.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Network |
| Category | Global Secure Access |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Logs and monitoring |
| Area | Logging and detection |
| Licence | Entra_Premium_Private_Access, Entra_Premium_Internet_Access, AAD_PREMIUM |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.