Monitor log profiles should have retention set to 365 days or greater
This control is non-compliant if Monitor log profile retention is set to less than 365 days. The Azure Policy audits the activity log if the retention is not set for 365 days or forever (retention days set to 0).
What this control checks
Monitor log profile retention must be 365 days or greater (or 0 days with retention disabled).
Common pitfalls
Retention days set to 0 means forever
This policy audits the activity log if the retention is not set for 365 days or forever (retention days set to 0).
Missing retention_policy fails
Checkov CKV_AZURE_37 fails when retention_policy is missing.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Activity log should be retained for at least one year" (b02aacc0-b073-424e-8298-42b22829ee0a); PowerPipe control azure_compliance.control.monitor_log_profile_retention_365_days.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_37; KICS query "Small Activity Log Retention Period" (2b856bf9-8e8c-4005-875f-303a8cba3918).
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to RS.AN-06 (Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved.).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved.
- 3.1.g Trails
Related controls
- PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 days
- Network security group flow logs should have retention set to greater than 90 days
- Key vaults should have resource logs enabled
- Search services should have resource logs enabled
- Storage account Table services should have Storage Logging enabled for 'Read', 'Write', and 'Delete' requests
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
monitor_log_profile_retention_365_days - Checkov Check:
CKV_AZURE_37 - Powerpipe Control:
azure_compliance.control.monitor_log_profile_retention_365_days - Azure Policy Definition:
b02aacc0-b073-424e-8298-42b22829ee0a - KICS Query:
2b856bf9-8e8c-4005-875f-303a8cba3918
Last reviewed: 2026-10-13