The Risky sign-ins report in Microsoft Entra ID Protection retains data for 30 days. This is the maximum period available for reviewing risky sign-in events directly in the Azure portal.

 he Risky sign-ins report in Microsoft Entra ID Protection retains data for 30 days. This is the maximum period available for reviewing risky sign-in events directly in the Azure portal.

Key Details:

Report Retention:

Risky sign-ins: 30 days of data.

Risky users: Also retained for 30 days.

Why 30 Days?

This is a fixed retention period defined by Microsoft’s service design.

It aligns with typical security investigation cycles for recent threats.