entra1-7  Exercise 2: Retention
=========================================================

Source: Microsoft Learn, "Microsoft Entra data retention". Re-check before
relying on any figure; retention and licensing change.

EARLIEST DATE VISIBLE (Free edition, today = 14 October)
  Audit logs and sign-in logs on Free: seven days. So on 14 October the
  oldest data is around 7 October. A failure "sometime in the first week of
  October, definitely before the 6th" is already outside the window. Honest
  answer: the logs probably cannot show it.

WITH P1
  Thirty days for audit and sign-in logs: back to about 14 September, so the
  failure would be visible. (Risky sign-ins: 7 days Free, 30 days P1, 90 days P2;
  not needed here.) Note that retention changes aren't retroactive: upgrading
  today would not bring back data that has already expired.

WHAT TO ASK THEM TO DO TODAY
  - Check whether anything from before 7 October was exported already
    (Log Analytics, a storage account, an event hub or a SIEM). Many tenants
    export without anyone remembering.
  - Look at any other evidence for the earlier period: the application's own
    logs on our side, user emails with the error text and times, ticket history.
  - Capture whatever the portal does show now (download as JSON or CSV), and
    check whether the failure is recurring so that new data can be gathered.
  - Ask for the secret or certificate expiry dates (Chapter 4); an expiry date
    can reveal the cause without any log.

THREE-LINE INSTRUCTION SO THE NEXT FAILURE ISN'T LOST
  1. As soon as a failure is reported, open Sign-in logs and Audit logs, filter
     to the application and the time, and download the results (JSON or CSV).
  2. Copy the error code, failure reason and correlation ID into the ticket
     the same day.
  3. For anything critical, ask the administrator to send logs to Log Analytics
     or a storage account so retention stops depending on the licence.

WHY THIS WORKS AS AN ANSWER
---
It uses the actual figures, admits what cannot be recovered, looks for other
sources of evidence, and turns the lesson into a habit.