1. For the default audit log retention policy, set Duration to 1 Year. Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies-in-the-security-compliance-center?view=o365-worldwide#create-or-edit-a-retention-policy Explanation: You can set the default audit log retention policy to retain log entries for up to one year by changing the "Duration" setting to "1 Year."
2. Create a retention policy that has a one-year retention tag and apply the policy to the user mailboxes in the legal department. Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies-in-the-security-compliance-center?view=o365-worldwide#create-or-edit-a-retention-policy