dhanyah01

Author: Markus Vilcinskas

articles/active-directory/active-directory-reporting-retention.md

@@ -13,38 +13,37 @@ ms.devlang: na
 ms.topic: article
 ms.tgt_pltfrm: na
 ms.workload: identity
-ms.date: 03/07/2016
+ms.date: 11/30/2016
 ms.author: dhanyahk
 
 ---
 # Azure Active Directory report retention policies
 *This documentation is part of the [Azure Active Directory Reporting Guide](active-directory-reporting-guide.md).*
 
-Azure Active Directory (Azure AD) reports retain data for a certain number of days, indicated here.
-
-| Report | Description |
-| --- | --- |
-| Sign-ins from unknown sources |30 days |
-| Sign-ins after multiple failures |30 days |
-| Sign-ins from multiple geographies |30 days |
-| Sign-ins from IP addresses with suspicious activity |30 days |
-| Sign-ins from possibly infected devices |30 days |
-| Irregular sign-in activity |30 days |
-| Users with anomalous sign-in activity |30 days |
-| Users with leaked credentials |30 days |
-| Audit report |180 days |
-| Password reset activity (Azure AD) |30 days |
-| Password reset activity (Identity Manager) |30 days |
-| Password reset registration activity (Azure AD) |30 days |
-| Password reset registration activity (Identity Manager) |30 days |
-| Self service groups activity (Azure AD) |30 days |
-| Self service groups activity (Identity Manager) |30 days |
-| Application usage |30 days |
-| Account provisioning activity |30 days |
-| Password rollover status |30 days |
-| Account provisioning errors |30 days |
-| RMS usage |30 days |
-| Most active RMS users |30 days |
-| RMS device usage |30 days |
-| RMS enabled application usage |30 days |
+
+
+This article provides an overview of data retention for the different Activity reports present in Azure Active Directory. 
+
+For Activity reports, for Premium and Premium 2 customers, we start collecting your activity data as soon as you sign-up for a Premium license. For free customers, we start collecting activity data as soon as you login into the portal or use our reporting APIs for the first time. 
+
+If you had already seeing reports in the Azure Classic portal, you will see your data immediately in the Azure Portal (new). If you haven’t turned on reporting through the old portal and logging into Azure Active Directory in Azure Portal and want to see these activity reports, it may take up 2 hours for you to see the data. We start collecting the data as soon as you log into the Azure Active Directory blade.
+
+For Security signals, we start collecting data as soon as you opt-in to use Identity Protection Center. 
+
+
+
+**Activity reports**	
+
+| Report | Azure AD Free | Azure AD Premium 1 | Azure AD Premium 2 |
+| :--    | :--           | :--                | :--                |
+| Directory Audit | 7 days | 30 days | 30 days |
+| Sign-in Activity |	7 days | 30 days | 30 days |
+
+**Security Signals**
+
+| Report | Azure AD Free | Azure AD Premium 1 | Azure AD Premium 2 |
+| :--    | :--           | :--                | :--                |
+| Users at Risk | 7 days | 30 days | 90 days |
+| Risky Log-ins | 7 days | 30 days | 90 days |
+