Microsoft Entra ID access reviews: Updated historical data retention policy for access reviews

Microsoft Entra ID is updating its data retention policy for access reviews. Starting August 15, 2025, only the last 12 months of access review data will be available via the user interface and APIs. Organizations should export historical data before this date and establish a routine for annual data storage.

We’re updating the data retention policy for access reviews in Microsoft Entra ID Governance to improve performance and align with data minimization principles. Starting August 15, 2025, only access review data from the last 12 months will be available via the user interface and APIs.

[How this affects your organization:]

Access review data older than 12 months will no longer be accessible through the Microsoft Entra portal or APIs. The Review history report will also be limited to the past 12 months. This change is on by default and does not affect audit logs. There are no admin controls for this change.

You are receiving this message because our telemetry indicates your organization may be using access reviews and relying on historical data exports beyond the new retention window.

[What you need to do to prepare:]

To avoid data loss, we recommend the following actions before August 15, 2025:

• Export all historical review data using Microsoft Graph APIs before August 15, 2025.
• To transfer historical data for compliance or audit purposes, use the script in the section called Example: Various queries that use access reviews in Create Custom Reports Using Microsoft Entra and Application Data - Microsoft Entra ID Governance | Microsoft Learn.
• Establish a routine for generating and securely storing review reports annually to ensure uninterrupted access to necessary data.
• Notify relevant admins and update internal documentation.

We’re committed to supporting your transition and ensuring continuity in your governance processes.

[Compliance considerations:]

• Does the change alter how existing customer data is processed, stored, or accessed (e.g. documents, emails, chats, etc.)? Yes, data will be stored for only 1 year and not more than that
• Does the change alter how admins can monitor, report on, or demonstrate compliance activities e.g. Purview or admin reporting? Yes. Before this rollout, APIs provide data for longer than 12 months. After this rollout, customers can only pull the data for the last 12 months.