Interactive and long-term retention duration meets the security baseline on every Microsoft Sentinel workspace
Overview
Section titled “Overview”Detection and incident response are bounded by data lifetime: an analytics rule, hunting query, or post-breach investigation can only see what is still in the workspace at the moment the query runs. Microsoft Sentinel separates retention into an interactive window (retentionInDays, the surface used by analytics rules, UEBA, and KQL hunting) and a total window (totalRetentionInDays, which adds Archive — accessible through search jobs and restore — on top of the interactive window). Threat-actor dwell time exceeds Sentinel’s default 30-day interactive window in a meaningful share of intrusions: living-off-the-land persistence, valid-account abuse (, /), and supply-chain compromise commonly precede detection by months. Without an explicit retention configuration, evidence required to reconstruct the kill chain is silently dropped: incident responders cannot pivot from a freshly discovered indicator back into Entra sign-in logs, Defender alerts, or proxy logs from 90 or 180 days ago, breaking timeline reconstruction. Compliance regimes (PCI DSS, ISO 27001, HIPAA, SOC 2) also impose log-retention floors that the Sentinel default does not satisfy. This check evaluates retention duration only; the storage plane the data sits on (Analytics vs. Basic vs. Auxiliary) is evaluated by spec 41217, and the Microsoft Sentinel data lake long-term plane is evaluated by spec 41218.
Remediation
Section titled “Remediation”Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Security information and event management |
| Product | Azure |
| Feature | Microsoft Sentinel |
| Area | Logging and detection |
| Licence | Consumption-based: Microsoft Sentinel |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.