Find table overrides before changing Log Analytics workspace retention

Source facts

Analytics-plan tables inherit their workspace’s default retention unless configured otherwise. Changing the workspace default affects tables still inheriting it, not tables whose analytics retention was already changed individually. The Tables view exposes both analytics and total retention for review. Microsoft Learn.

Analytics retention and total retention are different settings. Reducing the former without reducing the latter can move older data into long-term retention rather than discard it. Extending total retention applies to ingested data that has not already been removed; it does not restore deleted history. Microsoft Learn.

Applicability

This review is for Log Analytics tables using the Analytics plan. Establish the intended query-access period and total preservation period separately. Do not apply the workspace-default assumption indiscriminately to every table plan or treat this article as a retention requirement.

DSE recommendation

DSE recommends a per-table change manifest identifying inherited settings, explicit overrides and the desired outcome. Ask the data owner to approve exceptions instead of removing them merely for uniformity. Preserve the prechange values and record whether older records should remain interactively available or only retained longer term.

Verification

After an approved change, inspect every table in the manifest rather than checking only the workspace slider. Compare effective analytics and total retention with the approved pair of values. Investigate an unchanged table by checking for an override first. Retain the comparison and a representative data-access observation for the affected age range.

Official references

Microsoft Learn: Manage data retention.