Official documentation checked October 14, 2026.
“Copilot prompt logging retention” can mean two different requirements: retaining the audit trail of an interaction, or retaining the actual prompt and response. Microsoft Purview manages these as different records. Decide which evidence you need before changing a policy.
Do not run Set-AdminAuditLogConfig -AuditLogRetentionPeriod for this purpose. That parameter is not present in the documented command. The similarly named administrator audit settings are not a Copilot transcript-retention switch.
Separate Audit Metadata From Prompt and Response Content
Copilot audit records describe activity using fields such as operation, application context, message identifiers and accessed resources. Do not assume that an Audit export contains the full text of every prompt and response.
For a request such as “what did this user ask and what was returned?”, use the authorized eDiscovery workflow for AI interaction data. For “when did this interaction occur and which resources were recorded?”, Audit is the relevant starting point. Record the requested evidence type in the change request.
Review Audit Retention in Purview Audit
The current audit-retention guidance gives Audit Standard a 180-day default for records generated from October 17, 2023. Premium’s default one-year period is limited to specified workloads and eligible users; it is not a blanket one-year guarantee for every Copilot event.
An authorized administrator opens Microsoft Purview > Audit and reviews audit-retention policies. When a custom policy is justified, verify its users, record types or activities, duration and priority before saving. A blank scope field can mean all users or all record types, so inspect the resulting scope carefully.
Available durations and extended retention depend on licensing. There is no universal 365-day maximum. Do not promise that a newly changed policy restores already expired logs or retroactively changes every committed audit record.
Retain Interaction Content Through the Correct Location
For prompt and response content, use a Data Lifecycle Management retention policy. Microsoft’s creation procedure now includes Microsoft Copilot experiences separately from Teams chats. An older combined policy is a configuration to inspect, not a reason to create a new policy against the wrong workload.
Have the compliance owner approve the intended users, covered experience, retention period and end action. “Retain only,” “retain and then delete” and “delete only” serve different purposes. Use an approved pilot scope instead of assuming that an example duration is appropriate for the organization.
Review saved documents, emails and other source content separately. Retaining a Copilot interaction is not the same as retaining every underlying file version or every document created from its answer.
Remove the Incorrect PowerShell Shortcut From Runbooks
The official Set-AdminAuditLogConfig reference concerns administrator audit logging. Its AdminAuditLogAgeLimit parameter is for on-premises Exchange; it should not be substituted as a near-match for the nonexistent parameter previously described here.
Before automating retention, export or record the current policy through the approved administrative workflow, identify the exact record family and select its supported management interface. Have a second administrator review scope and deletion implications. Do not adapt a command merely until PowerShell accepts it.
Verify Evidence Without Deleting Production Records
Use an approved test account and a harmless, uniquely identifiable interaction. After processing, check for the expected Audit event and, separately, the retained content through an authorized eDiscovery search. A missing event may reflect the wrong time range, product filter, permissions or processing state; it is not immediate proof that auditing is disabled.
Microsoft’s Copilot retention guidance distinguishes backend compliance records from what appears in the chat interface. Do not use a disappearing chat as proof of complete deletion, and do not remove a legal hold to force a test to pass.
Keep the approved policy configuration, distribution result, test identifiers and observed outcomes together. This provides a defensible verification record without shortening production retention or purging evidence.