For over a year, my team has been opening support tickets with Microsoft regarding missing Dataverse audit records.
Support tickets:
- 2605030050000490
- 2603040050002449
- 2511040050004915
- 2602180050002627
Each case followed a similar pattern. We spent several weeks re-verifying the same information with the support engineer. The case would then be escalated to the Product team, who typically responded that telemetry had expired and no further investigation was possible. Requests to escalate to a supervisor were never successful.
On more than one occasion we were also told that auditing was working correctly because audit entries existed before and after the missing period. That didn't explain the issue we were reporting, which was that audit records for specific periods had disappeared while both older and newer records still existed.
After a year of investigations, I believe we have finally identified the cause ourselves.
In the Power Platform Admin Center → Audit Settings, we found that "Retain these logs for" was configured to 30 days.
What made this difficult to identify is that our environment still contains audit records dating back to 2019. Because we still had years of historical data, it never occurred to us that a 30-day retention setting could be the cause. Instead, it appeared that intermediate periods were being deleted while both older and newer audit records remained.
At no point during these four support cases did anyone ask us to verify this setting or suggest that it might be responsible. Instead, we were repeatedly asked to confirm that field-level auditing was enabled (it was), and we spent several remote sessions proving that we were querying the audit history correctly.
We have now changed the retention setting to Forever.
Based on the Microsoft documentation and my current understanding, audit records that were created while the retention was set to 30 days will continue to expire according to that original retention period, while new audit records created after the change will be retained indefinitely. As a precaution, we are exporting the remaining audit history to CSV while it is still available.
We've also implemented a temporary Power Automate process that copies each day's audit information elsewhere so that we have an additional record while we rebuild our audit history.
I have three questions for the community:
- Can anyone with experience in Dataverse auditing confirm whether the retention behavior described above is correct? Specifically, do audit records created while the retention period was 30 days continue to expire even after the retention setting is changed to Forever?
- How can I provide feedback or escalate our support experience? Four support cases over the course of a year without anyone identifying this configuration issue has been extremely frustrating, and I'd like to ensure the feedback reaches the appropriate team so other customers don't have the same experience.
- Is there any way to determine what changed this retention setting? We believe the behavior changed around July 2025, but we have no way to determine whether the retention setting itself changed at that time.
Thank you.
