Official documentation checked October 14, 2026.
Use Microsoft Purview Audit to investigate who interacted with organizational Copilot, when it happened and which resources were referenced. Use the Microsoft 365 usage report for adoption metrics. If an authorized investigation needs the actual conversation, use the appropriate eDiscovery workflow rather than assuming an audit export contains a transcript.
These evidence sources serve different purposes. An activity count is not a count of productive outcomes, and a missing event is not, by itself, proof that no one used Copilot.
Understand what a Copilot audit event contains
Microsoft documents CopilotInteraction as the operation for supported Copilot user interactions. Relevant properties can include AppHost, AppIdentity, message identifiers and references to accessed resources. The exact populated fields depend on the scenario.
A Messages entry identifies a prompt or response message; it is not a guaranteed copy of that message’s text. Do not look for invented universal fields called CopilotResponse or CopilotInteractionType. Use the current Copilot audit schema to interpret a record.
Microsoft Copilot auditing is included in Audit Standard for supported Microsoft scenarios when organization auditing is enabled. Do not assume only users with a paid Microsoft 365 Copilot add-on can generate relevant records; identify the actual application and account involved.
Search and export the relevant audit events
- Sign in to the Microsoft Purview portal with an account authorized to search audit records. Open Audit.
- Choose a date and time range covering the incident, accounting for the search interface’s time zone. Start with a known user and event time when possible.
- Use Activities – operation names to search for
CopilotInteraction. Run the search and inspect its completion status. - Open representative results. Compare the account, timestamp, application identity and referenced resource with the reported activity.
- Export the relevant results for approved analysis. If you need a particular
AppIdentity, Microsoft recommends filtering that property offline after exporting the operation-filtered records.
Retain the original export and record the query, time zone and export time. Work from a copy when filtering JSON fields. Restrict access to the export because identifiers and resource references can reveal sensitive information even without conversation text.
Find conversation content through eDiscovery
Where supported and retained, Copilot prompts and responses are represented by interaction items in users’ Exchange Online mailboxes. Microsoft’s eDiscovery guidance for AI application data describes the item classes and search workflow.
An authorized investigator should create the appropriate case and scope the search to relevant people, dates and application data. Search access requires the corresponding eDiscovery permissions; having an audit export does not itself grant access to everyone’s conversations.
The linked documentation also covers deletion. Do not follow its purge steps merely to investigate usage. Preserve evidence and existing holds unless the responsible compliance team explicitly authorizes a separate deletion procedure.
Check retention and missing results
The current Audit Standard default is 180 days, not the older 90-day figure. Audit Premium’s default one-year retention applies to specified workloads; it is not an automatic one-year guarantee for every Copilot record. Longer retention depends on the generating user’s eligible license and applicable retention policy. Review Microsoft’s audit retention rules for the actual record type.
If a search is empty, check the account and application, date range, time zone, search permissions, auditing configuration and ingestion delay. Remove one unnecessary filter at a time. For older activity, check whether the required evidence is still within its retention period. Enabling logging now does not reconstruct missing historical records.
Use the usage report for adoption, not transcripts
In the Microsoft 365 admin center, open Reports > Usage, select Microsoft Copilot > Copilot, then the Usage tab. The current report supports 7-, 28-, 90- and 180-day periods. Daily activity typically becomes available within 48 hours after that day ends in UTC. See the usage-report documentation.
Keep enabled users, active users and activity counts separate. Record the refresh date before comparing periods. Audit-based totals need not match usage-report metrics because their definitions and collection purposes differ; unexplained differences deserve investigation, not an assumed calculation error.