Microsoft Purview Audit licensing in 2026. License Premium for the few who need it.

Audit Standard keeps 180 days of records, which covers most investigations. License Premium only for the privileged, finance, legal and executive accounts that need it, and decide E5 on the rest of the bundle.

Microsoft Purview Audit comes in two licensed tiers, and the gap between them is a common argument for moving every user to Microsoft 365 E5. This guide covers what each tier does in 2026, which licenses carry Premium and how to buy it for only the users who need it.

For the wider SKU picture, see our Microsoft 365 license types comparison.

What is the difference between Purview Audit Standard and Audit Premium?

Audit Standard is included in Microsoft 365 E3, F1, F3 and Business Premium, among others, and keeps audit records for 180 days by default. Audit Premium adds one year of default retention for the main workloads, custom retention policies, an optional 10 year retention add on, more API bandwidth and some extra event detail.

Below both sits basic service logging: the mailbox and activity events each service records on its own, such as the Microsoft Entra sign in and audit logs. Those are useful for troubleshooting, and too short lived for an investigation.

What has changed in Audit Standard since 2023?

Standard has become much more capable. After the 2023 Storm-0558 intrusion into Exchange Online mailboxes, Microsoft faced public criticism that the logs needed to investigate it sat behind premium licenses, and it moved more into Standard.

• Retention. Standard records generated on or after October 17, 2023 are kept for 180 days, up from 90 days.
• Events. MailItemsAccessed, Send, SearchQueryInitiatedExchange and SearchQueryInitiatedSharePoint used to require Premium. They are now logged for Standard customers, with the rollout completed during 2024.
• What stayed in Premium. Intelligent insights now come down to extra properties, such as the sensitivity label on MailItemsAccessed records and app access context on Teams chat and meeting events.

An internal paper that argues for Premium because Standard cannot see mailbox access is out of date. Check current tier behavior against Microsoft's audit documentation before you size anything, since the defaults have changed more than once.

Which licenses include Audit Premium?

Microsoft's Purview licensing guidance lists Audit Premium in these offers:

• Microsoft 365 E5 and Office 365 E5. Also the A5 and G5 equivalents for education and government.
• Microsoft Purview Suite. The add on formerly sold as Microsoft 365 E5 Compliance, listed at $12 per user per month paid yearly, with Microsoft 365 E3 as the prerequisite.
• Microsoft 365 E5 eDiscovery and Audit. A narrower add on that carries Premium audit and eDiscovery without the rest of the Purview Suite. Microsoft does not publish a list price for it, so ask for a quote.
• 10 Year Audit Log Retention add on. Bought on top of one of the above for users whose records must be kept past one year.

Retention follows the license. The default one year policy applies only to users with E5 or an equivalent license, and records for everyone else, including guests, stay at 180 days. That per user behavior is what makes licensing a segment workable.

How many users actually need Audit Premium?

A small minority. In our engagements, between 5 and 20 percent of the workforce had a real need for Premium retention and search depth. They were privileged administrators and the finance, legal and executive accounts. The rest of the user base rarely justified either.

The need follows access rather than seniority. A domain administrator in a regional office carries more audit exposure than a senior vice president who reads email and approves expenses, because the administrator's own activity is the evidence in most incidents.

How do you size retention to the obligation?

1. Start with obligations you can name. Where a regulator or a contract specifies a period, the requirement is settled and the tier follows it.
2. Measure your actual forensics window. Check how far back past investigations had to search. Most work well inside 180 days, which Standard already covers.
3. Segment by role. Privileged access creates the audit requirement, so build the list from role assignments and group membership, not from job titles.
4. Treat retention beyond the response window as a compliance hedge. Price it as insurance with a known premium, and let the compliance owner sign off on the amount.
5. Target the records that matter. Premium allows up to 50 audit log retention policies, scoped by user, record type or activity, with durations from 7 days to 10 years. Extend what matters and leave the rest alone.
6. Buy the add on for the segment. Keep Standard for everyone else and revisit the split each year as roles change.

Is the request about audit logs or about records retention?

Many one year requests come from a records obligation, such as keeping email or financial documents for a set period. That is content retention, handled by Purview Data Lifecycle Management, and Microsoft 365 E3 already includes basic retention policies and manual retention labels.

The audit log records who did what to that content. Ask the compliance team which of the two the regulation names, because the answer often removes the audit requirement.

Is Purview audit a good reason to upgrade to Microsoft 365 E5?

Rarely on its own. The usual pitch is that Premium audit and one year retention come with E5, so audit becomes the reason to move every user. In our engagements, an add on for only the roles that needed it cost far less than a tenant wide E5 upgrade made for this requirement alone.

Audit retention is a control you size to the people who need it, and a poor reason to upgrade every seat in the company.

Audit works well as an upgrade argument because it changes the register of the conversation. A licensing discussion is a negotiation, where both sides expect to trade. A compliance discussion is about risk, and whoever argues for less appears to be accepting exposure.

Retention shifts the topic from the first category into the second with a requirement that sounds absolute: one year of audit logs, for everyone, because an incident might happen. Few procurement teams want to be on record pushing back on that.

Why we disagree with one year of retention for every user

The common advice from compliance teams and account managers is to keep one year of audit logs for everyone, because the cost of a missing log during an incident cannot be known in advance. We disagree. In the incidents we reviewed, the operational forensics window almost always fell inside 180 days, which Standard provides by default.

Premium earns its cost in a narrower and identifiable case: breach detection that lags, legal hold that is likely, or privileged accounts whose activity is itself the evidence. Those roles are countable. Once counted, they are a fraction of the workforce, and the requirement becomes something you license precisely.

Does your SIEM already keep the logs?

Check before you pay for retention twice. Many security teams already pull the unified audit log into Microsoft Sentinel or another SIEM through the Office 365 Management Activity API, which Standard supports. If the SIEM keeps those events for a year or more, Premium mostly buys search convenience and bandwidth, so price it on those terms.

How much does the Premium audit add on save compared with E5?

The add on is cheaper per seat, and the gap widens with every user who does not need Premium. At Microsoft's list prices, Microsoft 365 E3 is $39 and E5 is $60 per user per month paid yearly, a $21 step up. The Purview Suite costs $12 on top of E3, about 43 percent less per seat.

A worked example at list price

Say you run 4,000 users on Microsoft 365 E3. Counting administrators with privileged roles plus the finance, legal and executive groups gives 400 accounts, or 10 percent of the workforce. The compliance team wants one year of audit retention for them.

E3 and E5 users can be mixed in one tenant, so even the E5 route can be limited to the segment. The Purview Suite also brings insider risk management, advanced data loss prevention and eDiscovery Premium, which the compliance team may want for the same people.

The table shows a wider gap than the 40 to 70 percent we recorded in engagements, because it uses list prices and a clean 10 percent segment. Real quotes carry negotiated E5 pricing, larger segments and extra compliance add ons. Get quotes on every option for the same named users before you compare.

When does E5 win, and when does the add on win?

• E5 wins when several features land on one population: advanced security, advanced compliance, Teams Phone telephony and Premium audit all applying across most of the workforce at the same time.
• The add on wins when audit is the only gap. Put Premium audit on an E3 base for the segment that needs it.
• Either way, count first. The number of users who need the control decides the answer, and you can produce it in an afternoon.

One control needed by a tenth of the workforce does not make the case for E5. The wider decision is covered in our review of the E5 Security add on and the E5 shelfware guide.

What have we seen in recent Purview audit negotiations?

Across roughly 30 to 45 Microsoft 365 licensing engagements in 2024 and 2025, audit was repeatedly used to justify a full E5 upgrade. The qualifying population and the savings fell in the ranges given earlier, and three patterns recurred.

• Retention requested at one year without a named obligation. The figure came from a policy template or a vendor briefing, and no one could point to the regulation behind it.
• The forensics window never measured. No one had checked how far back past investigations had actually searched.
• A single control deciding a bundle. One logging feature carried the whole E5 business case.

More Microsoft material, including SKU comparisons and renewal timing, sits in our Microsoft knowledge hub.

How do you check who needs Audit Premium in your tenant?

You can produce the count from data you already hold. These sources cover most of it:

• Microsoft Entra admin center. Roles and administrators, plus Privileged Identity Management assignments if you use it, give you the privileged population.
• Directory groups. Finance, legal and executive groups define the rest of the segment, and the same groups will scope your retention policies later.
• Microsoft Purview portal. The Audit section shows which audit retention policies already exist and whom they cover.
• Microsoft 365 admin center. License reports show who already holds E5 or an add on, and usage reports show whether they use what they have.
• Incident records. For each closed security incident in the past two years, note the oldest log date the investigation needed. That one column settles most retention debates.

Our usage review guide covers the wider license review, and Microsoft 365 audit logs explained covers how the logs themselves work.

What will the Microsoft account team say about audit, and how should you answer?

Expect the account team to present audit as a reason to move the whole tenant to E5. These are the lines we hear most often, with the replies that hold up.

• "Premium audit is only available in E5." It is also in the Purview Suite and the E5 eDiscovery and Audit add on, both on an E3 base. Ask for a quote on each for the named users.
• "Your regulators expect one year of logs for everyone." Ask to see the clause. Where a regulation names a period you will meet it, and where it does not, you size retention to your incident history.
• "Licensing only part of the tenant creates compliance risk." Retention follows the license, and you will scope retention policies to licensed users. Ask Microsoft to confirm in writing that this setup matches the Product Terms.
• "The E5 step up discount is only on the table this renewal." Say you will judge E5 on the full bundle across the users who would use it, and that audit is priced separately.

What should the order form say?

• Reduction rights on the add on at each anniversary. The segment shrinks as roles change, and you should not pay for people who have moved on.
• A price hold on the add on for the full term. Small line items are easy to reprice at renewal.
• A path from the add on to E5 with credit for the remaining term. If a wider E5 case stands up later, you avoid paying twice for audit.
• Named pricing for the 10 Year Audit Log Retention add on. If legal hold is likely, agree the price now so the extension is not bought under time pressure.

How these terms fit into a full renewal is covered in our Microsoft EA renewal guide.

What to do next

1. List the obligations. Write down the regulatory and legal retention periods you can actually name, since those settle the requirement where they exist.
2. Identify the roles. Pull the privileged administrators and the finance, legal and executive accounts that need Premium retention and search depth.
3. Count the segment. Express it as a percentage of the workforce. That number usually ends the debate.
4. Price the options. Get quotes for the Purview Suite and the eDiscovery and Audit add on for that segment on an E3 base, and compare both with a tenant wide E5 move.
5. Match retention to licenses. Scope audit retention policies to the licensed users so that configuration and licensing agree.
6. Decide E5 separately. Judge it on the full bundle value, apart from the audit question. Our Microsoft advisory team can run that comparison with you.

Frequently asked questions