Setting Custom retention for AzureActivity and Usage data tables

Recently, Azure released an update that allows the AzureActivity and Usage data tables in Log Analytics Workspaces to keep data for longer periods of time while maintaining the workspace retention in the lowest retention configuration needed.

The minimum retention for AzureActivity and Usage remains 90 days to enable basic audit on operations and usability troubleshooting. You can set Azure Activity log retention for up to 730 days, learn more about that here.

You can configure this using REST or CLI, as usual I prefer the CLI so here’s that little code tidbit for your reference. Let’s set the AzureActivity retention to 187 days to meet our business requirement:

az monitor log-analytics workspace table update --resource-group $resourceGroup --workspace-name $workspaceName --name AzureActivity --retention-time 187

If you prefer to set via REST:

PATCH https://management.azure.com/subscriptions/subscription-id/resourcegroups/resource-group-name/providers/Microsoft.OperationalInsights/workspaces/workspace-name/tables/AzureActivity?api-2020-10-01

Authorization: Bearer ---tokenvaluehere---
Content-type: application/json
{
"properties": {
"retentionInDays": 187,
}
}