When troubleshooting Copilot behavior or verifying usage patterns, you may need to review activity logs for one person in your organization. Microsoft 365 records Copilot interactions in the unified audit log, but finding entries for a single user requires the correct search filter. This article explains how to locate and interpret Copilot activity logs for an individual user using the Microsoft 365 Purview compliance portal. You will learn the exact search parameters to apply and how to export the results for further analysis.
Key Takeaways: Finding Copilot Logs for One User
- Microsoft 365 Purview portal > Audit > Search > User filter: Type the user’s email address to restrict results to that person’s Copilot actions.
- Copilot activity record type (CopilotInteraction): Each log entry captures the prompt, response summary, timestamp, and the application where Copilot was used.
- Export > CSV > Filter by User Principal Name: After exporting the audit log to a CSV file, you can sort or filter the User column to isolate one user’s records.
What Copilot Activity Logs Contain
Copilot activity logs are stored in the Microsoft 365 unified audit log. Each record includes a timestamp, the user who performed the action, the application where Copilot was used such as Word, Excel, PowerPoint, or Teams, the prompt text, and a response summary. The record type for Copilot interactions is CopilotInteraction. These logs do not include the full response content. They capture metadata about the interaction. To view logs for a specific user, you must apply a user filter before running the search. Without this filter, the search returns all Copilot interactions across the tenant, which can be difficult to navigate.
Prerequisites for Accessing Audit Logs
You need the Audit Log role in the Microsoft 365 Purview compliance portal. This role is included in the Compliance Administrator, Audit Logs, and Organization Management role groups. You also need a Microsoft 365 E5 or E5 Compliance license for the user performing the search. The audit logging feature must be turned on for the tenant. It is enabled by default for organizations with E5 subscriptions.
Steps to Search Copilot Logs for One User in Purview
Follow these steps to run a targeted audit log search for a single user’s Copilot activity.
- Open the Microsoft 365 Purview compliance portal
Sign in to compliance.microsoft.com with an account that has the Audit Log role. In the left navigation, expand Audit and select Audit log search. - Set the date range
In the Date range field, choose a start and end date. To see recent logs, select the last 7 days. For historical searches, pick a custom range up to 90 days. - Select the Copilot activity record type
In the Record type dropdown, scroll to CopilotInteraction and select it. If you do not see this option, type Copilot in the search box above the list. - Enter the user’s email address
In the User field, type the full email address of the user whose logs you want to check. You can enter multiple addresses separated by semicolons, but for a single user, enter only one address. - Run the search
Click Search. The portal displays a list of matching Copilot interactions. Each row shows the date, user, application, and a summary of the prompt. Click any row to view the full details pane. - Export the results if needed
To download a CSV file, click Export and choose Download all results. The CSV contains columns for CreationDate, UserIds, Operations, and more. You can filter the UserIds column to isolate one user’s records.
Using the Audit Log Search Filters for Better Precision
The User filter in the Purview portal restricts the search to actions performed by that user. If you need to narrow further, use the Activity filter. For Copilot, the available activities include Copilot interaction, Copilot feedback submitted, and Copilot settings changed. Selecting one activity type reduces the result set to only that kind of interaction.
Common Issues When Checking Copilot Logs for a Specific User
No Results Appear After Applying the User Filter
If the search returns zero records, first confirm the user has actually used Copilot in the selected date range. The user may not have a Copilot license. Verify the user’s license assignment in the Microsoft 365 admin center under Users > Active users > Licenses and apps. Also check that audit logging is enabled. Go to Audit > Audit log search and look for the banner at the top that says Audit log search is turned on.
CopilotInteraction Record Type Is Missing from the Dropdown
The CopilotInteraction record type was introduced in late 2023. If you do not see it, the tenant may not have received the update yet. Clear your browser cache and reload the Purview portal. If the record type still does not appear, use the Search box inside the Record type dropdown and type Copilot. The system will filter the list to show matching record types.
Exported CSV Contains All Users Despite the User Filter
The export function downloads all results from the current search query. If the search was correctly filtered to one user, the CSV should only contain that user’s records. If the CSV contains records for other users, the User filter may have been cleared before clicking Export. Re-run the search with the User filter applied. After downloading, open the CSV and verify the UserIds column content.
Copilot Activity Logs vs Other Audit Logs: Key Differences
| Item | Copilot Activity Logs | Standard Audit Logs |
|---|---|---|
| Record type | CopilotInteraction | Varies by service, such as File, Exchange, or SharePoint |
| Data captured | Prompt text, response summary, application name, timestamp | Operation name, target object, client IP, timestamp |
| Retention period | 90 days for E5 licenses, 180 days with add-on | 90 days for most record types, up to 10 years with add-on |
| User filter available | Yes, in Purview Audit search | Yes, in Purview Audit search |
| Export format | CSV with UserIds, Operations, and AuditData columns | CSV with same column structure |
The main difference is the record type and the specific metadata in the AuditData column. Copilot logs include the prompt and response summary. Standard logs include the operation name and the object that was accessed. Both log types use the same search interface and export process.
You can now search Copilot activity logs for any individual user in your tenant using the Purview audit log search with the User filter and the CopilotInteraction record type. Export the results to a CSV file for offline analysis or reporting. For deeper investigation, combine the User filter with a specific date range and activity type. This method works for all Copilot applications, including Word, Excel, PowerPoint, and Teams.