M365 Audit Log Retention: Meeting CMMC AU Family Requirements
CMMC Level 2 expects you to create and retain audit logs long enough to support investigations, and Microsoft 365 can meet that need when you configure Purview Audit retention to match your policy, scope, and licensing.