Explanation:
Box 1: 30 days
The minimum value for the Interactive (Analytics) retention setting for the AzureActivity table in a Microsoft Sentinel workspace is four days, though the default is 90 days and a value between 30-
730 days is the standard range for Analytics Logs.
Note: To minimize costs for the AzureActivity table in Microsoft Sentinel, you should adjust its data retention settings in the Log Analytics workspace. Navigate to Data retention under the Usage and estimated costs section of your workspace and decrease the Interactive retention period for that table to a duration that meets your security and compliance needs, while enabling Total retention (or long-term retention) to keep older data at a much-reduced cost for infrequent investigations.
Box 2: 2 years
3. Set Total Retention:
Ensure Total retention is enabled for the AzureActivity table.
Adjust the total retention period to store older data for longer, less frequent use, at a significantly lower cost than interactive retention. You can set this for up to 12 years, which can be crucial for audit or sporadic investigations.
Reference:
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-configure