Azure Compliance ControlsAzure Monitor
Monitor log profiles should have retention set to 365 days or greater
This control is non-compliant if Monitor log profile retention is set to less than 365 days. The Azure Policy audits the activity log if the retention is not set for 365 days or forever (retention days set to 0).
What this control checks
Monitor log profile retention must be 365 days or greater (or 0 days with retention disabled).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved.
- 3.1.g Trails
Related controls
- PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 days
- Network security group flow logs should have retention set to greater than 90 days
- Key vaults should have resource logs enabled
- Search services should have resource logs enabled
- Storage account Table services should have Storage Logging enabled for 'Read', 'Write', and 'Delete' requests
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
monitor_log_profile_retention_365_days - Checkov Check:
CKV_AZURE_37 - Powerpipe Control:
azure_compliance.control.monitor_log_profile_retention_365_days - Azure Policy Definition:
b02aacc0-b073-424e-8298-42b22829ee0a - KICS Query:
2b856bf9-8e8c-4005-875f-303a8cba3918
Last reviewed: 2026-10-13