You need to configure Microsoft Sentinel to meet the technical requirements.

Set Analytics retention to 2 years . The case states that the DnsEvents table uses the Analytics tier and requires data to be retained for the maximum supported duration without changing the tier . For a Log Analytics table using the Analytics plan, Microsoft currently supports an Analytics—or interactive—retention period of up to 730 days (two years) . During this period, the data remains directly available for high-performance KQL queries, Microsoft Sentinel analytics rules, hunting, workbooks, and other real-time security operations.

The important distinction is between Analytics retention and total retention . Microsoft Sentinel can retain data for up to 12 years in long-term/Data Lake retention , but data beyond the Analytics retention period is no longer maintained as normal interactive Analytics-tier data. Access to long-term data uses mechanisms such as search jobs or the Data Lake tier. Therefore, 12 years does not satisfy a question specifically asking for the maximum Analytics retention .

The other choices—180 days and one year—are valid durations but are below the maximum. Six years exceeds the two-year Analytics limit.