How to Transfer Microsoft Sentinel Logs to Azure Storage
-
You may need your Sentinel logs in long-term retention based on government requirements. Azure Log Analytics starts charging for such retention after 90 days have elapsed. However, you can use a Playbook that creates an Azure Storage account and, after 90 days, automatically moves such logs to cold storage to avoid retention billing.
Read the article by Nicolas Prigent, a three-time Microsoft MVP, on how to leverage a Microsoft Playbook to move Sentinel logs to Azure cold storage for retention automatically.
