How to Audit Files Referenced by Microsoft Copilot

Official documentation checked October 14, 2026.

Microsoft Purview can show resource references associated with Copilot interactions. Start with the CopilotInteraction operation—not a combination of SharePoint’s FileAccessed operation and a Copilot workload filter.

The result is investigation evidence, not a guaranteed complete list of every byte or document fragment the service considered. Preserve that distinction when reporting findings to a security or compliance team.

Understand which record answers your question

Microsoft’s Copilot audit documentation describes interaction records containing user, time, application context, and accessed-resource references. Fields such as AccessedResources, AppHost, and AppIdentity help distinguish scenarios.

A SharePoint file-access event can be useful supporting evidence, but the same operation is not a definitive Copilot attribution method. Nor should you expect one separate Copilot file-read event for every referenced document.

Define the investigation first: a particular response, one user’s activity, a sensitive resource, or a period of usage. Avoid collecting the entire organization’s history when a narrow question will suffice.

Search for the Copilot interaction

1. Use an account authorized to search audit records and open Microsoft Purview, then Audit.
2. Select the relevant date range and user. Record the time zone so the search window can be reproduced.
3. Use Activities – operation names to search for CopilotInteraction. Add supported workload or record-type filters only after confirming they match the scenario.
4. Run the search and inspect matching record details. Check the application context rather than assuming every Copilot record came from Word or Chat.
5. Export relevant results when detailed analysis is required. If filtering by AppIdentity is needed, Microsoft’s guidance describes filtering exported results offline.

Keep an unchanged copy of the export and record the search parameters. Store the evidence in an approved restricted location; file names and URLs can themselves disclose sensitive information.

Interpret resource references carefully

Inspect the resource information actually present in the record, such as its identifier, name, site URL, action, or sensitivity-label identifier. Do not invent a CopilotSessionId field or assume all workloads populate every field.

Resolve a cited resource using an account authorized to view it. Compare the event time, user, app, and resource with the incident being investigated. If correlating records, use the identifiers available in those records and document the basis of the match.

A resource reference does not prove which sentences influenced the answer or whether the answer accurately represented them. For actual conversation content, use an authorized eDiscovery workflow where supported. Audit metadata and retained interaction content are different evidence types.

Investigate empty or incomplete results

• Confirm auditing is enabled and that your role permits the search. When organization auditing is enabled, Microsoft describes Copilot auditing as included in Audit (Standard); it is not an E5-only activation feature.
• Check the selected account, application, operation, time zone, and ingestion delay.
• Check whether the event remains within the applicable retention window.
• Use a harmless known test interaction to validate the search, without treating that test as proof of universal coverage.

Do not report “Copilot read no files” solely because a search returned zero rows. Browser and mobile entry points are not categorically unaudited; identify the actual organizational scenario and its documented event format.

Check retention before relying on historical evidence

Current audit-retention guidance gives Audit (Standard) a 180-day default for current records. Premium’s default one-year treatment applies to specified workloads and qualifying users; do not assume every Copilot event receives it. Custom retention and longer periods have their own licensing and policy requirements.

For ongoing reviews, agree the required period, authorized reviewers, and approved evidence-storage location. An export can preserve selected evidence, but it does not retroactively recover expired records or replace a correctly scoped retention policy.

In your conclusion, state the searched scope, matched events, available resource references, and limitations. “These resources were referenced in these recorded interactions” is more defensible than “this is every file Copilot has ever read.”