Microsoft finally expands free logging—but only for govt agencies

Microsoft expanded free Purview Audit logging and increased default log retention from 90 to 180 days for standard customers after disclosure of a breach in which the Chinese-linked APT Storm-0558 used a stolen Microsoft account key to forge tokens and access Exchange Online mailboxes, exfiltrating emails from about 25 organizations (including tens of thousands of State Department emails). The change, aligned with CISA and federal guidance, aims to give agencies the telemetry needed to detect similar attacks that previously required premium logging licenses.