How to Search Copilot Prompts in Microsoft Purview eDiscovery

When your organization uses Microsoft Copilot, users generate prompts that interact with Microsoft 365 data. Legal or compliance teams often need to locate specific prompts during investigations or audits. Microsoft Purview eDiscovery can capture and search these prompts if your tenant has the correct licensing and audit logging enabled. This article explains how to configure audit logging for Copilot interactions and how to search for Copilot prompts using eDiscovery tools in the Microsoft Purview portal.

Why Copilot Prompts Need Special Handling in eDiscovery

Copilot interactions are logged as audit events in Microsoft 365, but they are not automatically available in eDiscovery searches. The system treats Copilot prompts and responses as part of the CopilotInteraction workload. By default, audit logging for this workload is turned off in many tenants. Without enabling it, eDiscovery searches return zero results for Copilot-related content. Additionally, the audit records are stored in the unified audit log, not in individual user mailboxes or SharePoint sites. This means standard eDiscovery content searches for user mailboxes will not find Copilot prompts. You must use eDiscovery (Premium) or audit log search with specific filters to locate them.

Licensing Requirements

To search Copilot prompts in eDiscovery, your organization needs one of the following subscriptions:

• Microsoft 365 E5 or A5
• Microsoft 365 E5 Compliance or A5 Compliance
• Microsoft 365 E5 eDiscovery and Audit add-on
• Microsoft 365 Copilot license (for the user generating prompts)

Without E5 or the Compliance add-on, you cannot use eDiscovery (Premium) or access the full audit log for Copilot events.

Steps to Enable Audit Logging for Copilot Interactions

Before you can search Copilot prompts, audit logging must be turned on for the Copilot workload. This is a tenant-wide setting in the Microsoft Purview portal.

1. Open the Microsoft Purview portal
   Go to https://purview.microsoft.com and sign in with an account that has the Audit Logs role or Compliance Administrator role.
2. Navigate to Audit solutions
   In the left navigation, select Audit under Solutions. If you do not see Audit, select Show all at the bottom of the navigation pane.
3. Turn on audit logging
   If audit logging is not already enabled, you will see a banner at the top of the Audit page. Click Start recording user and admin activity. This enables audit logging for all workloads, including Copilot.
4. Verify Copilot workload is audited
   After enabling audit logging, run a test search. In the Audit search page, set the Activities dropdown to Copilot activities. Select Copilot interaction from the list. Click Search. If results appear, Copilot audit logging is active.

Audit records for Copilot interactions start populating within 30 minutes of enabling the setting. You do not need to restart any services or notify users.

How to Search Copilot Prompts Using eDiscovery (Premium)

Once audit logging is active, you can search Copilot prompts using eDiscovery (Premium). This method provides advanced filtering, review sets, and export options.

Create an eDiscovery (Premium) Case

1. Open eDiscovery (Premium)
   In the Microsoft Purview portal, select eDiscovery > eDiscovery (Premium) under Solutions.
2. Create a new case
   Click the Cases tab, then click Create a case. Enter a name and description, such as “Copilot Prompt Review Q1 2025.” Click Save.
3. Open the case
   Click on the case name to open it. Under the Searches tab, click New search.

Configure the Search Query for Copilot Prompts

1. Set the data sources
   In the search creation wizard, select All mailboxes and all sites if you want to search all users. Alternatively, select Choose specific mailboxes or sites and add the user accounts whose Copilot prompts you need to review.
2. Add the Copilot workload filter
   In the Keyword query field, enter the following KQL query:
   Workload: CopilotInteraction
   This filter returns only audit records generated by Copilot, excluding all other Microsoft 365 activities.
3. Refine by date and user
   To narrow results further, add date ranges and user filters. Example query:
   Workload: CopilotInteraction AND Date: >= 2025-01-01 AND Date: <= 2025-03-31 AND User: user@contoso.com
4. Run the search
   Click Next, review the settings, and click Submit. The search will return all Copilot prompts and responses for the specified users and time range.

Review and Export Copilot Prompt Results

1. Open the search results
   After the search completes, click on the search name. Under the Results tab, click Review samples to view the actual Copilot prompts and responses.
2. Add to review set
   Select the relevant items and click Add to review set. This creates a static set of records for detailed analysis.
3. Export data
   In the review set, click Export to download the Copilot interaction records as CSV or JSON files for legal review.

Common Issues When Searching Copilot Prompts in eDiscovery

No Results Returned for CopilotInteraction Filter

If your search returns zero results despite audit logging being enabled, check the following:

• Confirm that the user accounts you are searching have actually used Copilot within the date range. Copilot only generates audit records when a user sends a prompt.
• Verify that audit logging has been enabled for at least 30 minutes. Records may not appear immediately.
• Ensure your eDiscovery (Premium) license is active. Without E5 or the Compliance add-on, the CopilotInteraction filter may not work.

Copilot Prompts Missing from Review Set

After adding items to a review set, you may find that some prompts are missing. This can happen if the audit retention period has expired. By default, audit logs are retained for 90 days. To preserve Copilot records for longer, create a retention policy in the Microsoft Purview portal under Data Lifecycle Management > Microsoft 365 retention policies. Set the retention period to match your legal requirements.

Search Returns Only Copilot Responses, Not Prompts

The CopilotInteraction audit record includes both the user prompt and the Copilot response in the same event. If you see only response text, check the AuditData column in the exported CSV. The prompt is stored in the PromptText field, and the response is in the ResponseText field. Both fields are included in the same record.

Feature	Audit Log Search (Basic)	eDiscovery (Premium)
Search Copilot prompts	Yes, with CopilotInteraction filter	Yes, with CopilotInteraction filter
Export to CSV	Yes, limited to 50,000 records	Yes, unlimited with review sets
Retention control	Default 90 days	Extendable via retention policies
Advanced analytics	No	Yes, including text analysis and tagging
Licensing required	E3 with Audit add-on	E5 or E5 Compliance add-on

To search Copilot prompts effectively, use eDiscovery (Premium) when you need long retention, advanced filtering, or large-scale exports. Use basic audit log search for quick checks on recent prompts.

You can now search Copilot prompts in Microsoft Purview eDiscovery by enabling audit logging, using the CopilotInteraction workload filter, and creating eDiscovery cases. Start by verifying your tenant has the correct E5 or Compliance license. Next, enable audit logging if it is not already active. For long-term investigations, create a retention policy to keep Copilot records beyond the default 90 days. A useful next step is to set up an eDiscovery (Premium) case with a saved search query that you can reuse monthly for ongoing compliance reviews.