a) For the default audit log retention policy, set Duration to 1 Year. Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies-in-the-security-compliance-center?view=o365-worldwide#create-or-edit-a-retention-policy You can set the default audit log retention policy to retain log entries for up to one year by changing the "Duration" setting to "1 Year." c) Create a retention policy that has a one-year retention tag and apply the policy to the user mailboxes in the legal department. Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies-in-the-security-compliance-center?view=o365-worldwide#create-or-edit-a-retention-policy You can create a retention policy with a one-year retention tag, and then apply the policy to the user mailboxes in the legal department. This will ensure that the audit log entries for those users are retained for up to one year as per the retention tag.