How to Audit Copilot Prompt Content With Purview Audit

Microsoft Purview Audit enables compliance and security teams to log and review every Copilot interaction across Microsoft 365 services. When users ask Copilot questions or generate content, the prompt text and the response are recorded in the unified audit log. This article explains how to configure Purview Audit to capture Copilot prompt content, search the audit log for specific prompts, and export the results for analysis. By following the steps below, you can meet internal governance requirements and investigate potential data exposure incidents.

How Purview Audit Captures Copilot Prompt Content

Microsoft Purview Audit logs every Copilot interaction that occurs in Microsoft 365 services such as Word, Excel, PowerPoint, Teams, and Outlook. When a user submits a prompt, the audit log records the following data:

• Timestamp of the interaction
• User who submitted the prompt
• Full text of the prompt
• Full text of the Copilot response
• Application or service where the prompt was used
• Session ID for grouping related interactions

The audit log captures these details regardless of whether the user is on a Copilot Pro license or a Copilot for Microsoft 365 license. However, the audit functionality itself requires an appropriate Purview license. Organizations must have at least one of the following:

• Microsoft 365 E5/A5/G5 subscription
• Microsoft 365 E5/A5/G5 Compliance add-on
• Microsoft 365 E5/A5/G5 eDiscovery and Audit add-on

Without these licenses, the audit log may still record some events, but the prompt and response content will be truncated or omitted. The feature that enables full prompt content logging is called Audit (Premium). Audit (Standard) records only the fact that a Copilot interaction occurred, not the actual text.

What Gets Logged in Audit (Premium)

When Audit (Premium) is enabled, each Copilot interaction generates an audit record with the schema type CopilotInteraction. The record includes two key properties:

• Prompt — the exact text the user typed or spoke
• Response — the exact text Copilot returned

The audit record also includes metadata such as the application name, the user’s IP address, and a unique identifier for the session. This data is retained according to the retention policy configured in Purview, which ranges from 90 days to 10 years depending on the license.

Steps to Search for Copilot Prompts in the Audit Log

Before you can search for Copilot prompt content, confirm that Audit (Premium) is enabled for your tenant. If you have a qualifying license, Audit (Premium) is turned on by default. To verify, go to the Microsoft Purview compliance portal and check the Audit solution settings. If you see the option to enable Audit (Premium), activate it.

1. Open the Microsoft Purview compliance portal
   Sign in to https://compliance.microsoft.com with an account that has the Audit Log or View-Only Audit Log role. These roles are included in the Compliance Administrator and Audit Administrator role groups.
2. Navigate to Audit
   In the left navigation pane, select Audit. The Audit solution page opens with the New Search tab selected.
3. Set the workload filter to Copilot
   Click the Workload dropdown list and select Copilot. This filter shows only events related to Copilot interactions. If you do not see Copilot in the list, ensure Audit (Premium) is enabled.
4. Define the date range
   In the Start date and End date fields, set the time period you want to audit. The default is the past 7 days. You can search up to 90 days with Audit (Standard) or up to 1 year with Audit (Premium).
5. Add optional filters for precise results
   Click Add filter and choose from the following options:
   – User: Enter the UPN of a specific user to see only their prompts
   – Activity: Already pre-filtered to Copilot activities when the workload is set to Copilot
   – Keyword: Enter a word or phrase that appears in the prompt or response text. This is useful for finding prompts about a specific topic.
6. Run the search
   Click Search. The results appear in a table below the search form. Each row shows the date, user, activity, and workload. To see the full prompt and response, click any row to open the details pane.
7. View the prompt and response content
   In the details pane, scroll to the Prompt and Response fields. These fields contain the full text of the interaction. If the fields are empty or show “No content available,” the tenant does not have Audit (Premium) enabled for that interaction.

Exporting Copilot Audit Records for Analysis

After you have identified relevant Copilot interactions, you can export the audit records to a CSV file for offline review, reporting, or archival. The export includes all columns visible in the search results plus the prompt and response content.

1. Run your Copilot audit search
   Follow the steps in the previous section to generate a list of Copilot interactions. Ensure the search results contain the records you want to export.
2. Click Export
   On the Audit search results page, click the Export button at the top of the results table. A dropdown menu appears with two options: Download all results and Download selected results.
3. Choose the export scope
   Select Download all results to export every record matching your search criteria. Select Download selected results after checking the boxes next to specific rows. The file downloads as a CSV file named AuditSearchResults.csv.
4. Open the CSV file
   Open the file in Excel or any CSV viewer. The columns include CreationDate, UserIds, Operations, Workload, Prompt, and Response. The Prompt and Response columns contain the full text of each interaction.

Common Issues When Auditing Copilot Prompt Content

Prompt and Response Fields Are Empty

If the details pane shows empty Prompt and Response fields, the tenant does not have Audit (Premium) enabled for the specific user or workload. Verify the user has an E5 license or equivalent add-on. Also confirm that Audit (Premium) is enabled in the Purview settings. If the user has the correct license but the fields remain empty, the interaction may have occurred in a service that does not support full content logging. As of this writing, all major Microsoft 365 Copilot services support full content logging when Audit (Premium) is active.

Copilot Workload Filter Is Missing

If the Workload dropdown does not include Copilot, the tenant is running Audit (Standard) only. Upgrade to Audit (Premium) by assigning the appropriate licenses. The filter appears within 24 hours of license activation.

Export Contains Too Many Unrelated Events

When the Workload filter is not set to Copilot, the export includes all audit events from all workloads. Always set the Workload filter to Copilot before clicking Search and Export. Use the Keyword filter to narrow results to specific prompt text if needed.

Purview Audit Standard vs Audit Premium for Copilot

Item	Audit Standard	Audit Premium
Copilot interaction logged	Yes, metadata only	Yes, full prompt and response text
Prompt text available	No	Yes
Response text available	No	Yes
Required license	Any Microsoft 365 license	Microsoft 365 E5/A5/G5 or add-on
Search retention	90 days	Up to 1 year
Export format	CSV with metadata columns	CSV with Prompt and Response columns

You can now audit Copilot prompt content by using the Microsoft Purview compliance portal. Start by verifying that your tenant has Audit Premium enabled and that users hold the required licenses. Then use the Workload filter set to Copilot and the Keyword filter to locate specific interactions. For compliance documentation, export the results to CSV and review the Prompt and Response columns. An advanced tip: create a scheduled search in Purview to run automatically every week and email the results to your compliance team, ensuring continuous monitoring without manual effort.