How to Export Microsoft 365 Copilot Audit Logs From Purview

You need to export Copilot audit logs from Microsoft Purview to track how users interact with Copilot across Microsoft 365. Audit logs record every Copilot action, including prompts, generated responses, and accessed data sources. Microsoft Purview is the only official tool that captures these logs with full detail. This article explains how to search, filter, and export those logs as a CSV file for compliance or analysis.

What Copilot Audit Logs Capture and Why You Need Them

Copilot audit logs record every interaction a user has with Copilot in Microsoft 365 apps. Each log entry includes the user who triggered the action, the timestamp, the type of activity, and metadata about the data sources Copilot accessed. Typical Copilot activities include generating a document summary in Word, drafting an email in Outlook, or answering a question in Teams.

These logs are essential for compliance teams, security analysts, and IT administrators. They help you verify that Copilot is used within your organization’s data governance policies. For example, you can confirm that Copilot did not access sensitive files or that users did not share confidential information through prompts. The logs also support internal audits and regulatory reporting requirements such as GDPR or SOC 2.

Before you can export logs, your tenant must have the unified audit log enabled. This is turned on by default for Microsoft 365 E5 and A5 subscriptions. For E3 or Business Premium subscriptions, you must enable auditing manually in the Purview compliance portal. Also, the user running the export needs the Audit Logs role in Purview or must be a member of the Compliance Management or Organization Management role group.

Steps to Search and Export Copilot Audit Logs

1. Sign in to Microsoft Purview
   Go to https://compliance.microsoft.com and sign in with your admin credentials. The account must have the Audit Logs role or equivalent permissions.
2. Open the Audit solution
   In the left navigation pane, select Audit. If you do not see Audit, click Show all to expand the full menu.
3. Configure the search parameters
   On the Audit page, set the following fields:
   – Date range: Select a start and end date. The maximum range is 90 days for E5 tenants and 180 days for add-on audit retention.
   – Workload: Choose Copilot from the dropdown. This filters results to Copilot.Operation events only.
   – Activities: Click the activity list and select Copilot interaction. This captures all prompt-and-response actions.
   – Users: Leave blank to search all users, or enter a specific user email to narrow results.
4. Run the search
   Click the Search button at the bottom of the pane. Purview will display results in a table. Large searches may take several minutes to complete.
5. Review the results
   After the search finishes, the results table shows columns for Date, IP address, User, Activity, and Item. Click any row to open the details pane. The details pane contains the full audit record, including the Copilot prompt text, the generated response, and the list of data sources accessed.
6. Export the logs to CSV
   Click the Export button above the results table. Choose Export all results to download a CSV file containing every log entry from the search. The CSV file includes all columns visible in the table plus hidden metadata columns. Save the file to your local drive or a secure shared folder.

Using Advanced Filters for Specific Copilot Activities

If you need to find a particular type of Copilot action, use the Activities filter more granularly. The Copilot.Operation workload includes sub-activities such as:

• Copilot interaction in Word
• Copilot interaction in Excel
• Copilot interaction in PowerPoint
• Copilot interaction in Teams
• Copilot interaction in Outlook

Select one or more of these sub-activities to narrow the export to a specific app. This is useful if you want to audit only Teams-based Copilot usage, for example.

Exporting Logs via PowerShell

For automated or recurring exports, use the Exchange Online PowerShell module. This method is faster for large datasets and supports scripting.

1. Connect to Exchange Online PowerShell
   Open PowerShell as an administrator and run Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com. Sign in with your admin credentials.
2. Run the Search-UnifiedAuditLog cmdlet
   Execute the following command to search for Copilot interactions from the last 7 days:
   Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -Operations "CopilotInteraction" -ResultSize 5000 | Export-Csv -Path "C:\Logs\CopilotAudit.csv" -NoTypeInformation
   Adjust the date range and file path as needed. The -ResultSize parameter limits the number of records. Set it to Unlimited for all results.
3. Verify the exported file
   Open the CSV file in Excel or a text editor. The file contains columns such as CreationDate, UserIds, Operations, AuditData, and more. The AuditData column contains the JSON payload with the full Copilot interaction details.

If the Export Fails or Returns No Data

Search returns zero results

This usually means auditing is not enabled for your tenant. Go to Purview > Audit > Audit log and check the banner at the top of the page. If it says “Start recording user and admin activity,” click it to enable auditing. After enabling, wait 30 minutes for logs to populate, then run the search again.

Export button is grayed out

The export button becomes active only after the search finishes. If it remains grayed out, the search may still be running. Wait for the results table to populate fully. If the search is stuck, refresh the page and run a shorter date range, such as 24 hours.

CSV file is empty or truncated

When using the Export all results option, Purview limits the export to 50,000 records per file. If your search returns more than 50,000 entries, Purview creates multiple CSV files. Check your download folder for files named AuditLog_1.csv, AuditLog_2.csv, and so on. For PowerShell exports, increase the -ResultSize parameter or use a loop to page through results.

PowerShell returns an access denied error

The account running the PowerShell command must have the Audit Logs role in Purview. Verify your role assignment in Purview > Roles & scopes > Permission groups. If you are a global admin, you already have this role. If not, ask a global admin to add you to the Compliance Management role group.

Copilot Audit Log Export Methods: Comparison

Item	Purview Web UI	PowerShell
Best for	Ad-hoc, one-time exports with visual filtering	Automated, recurring exports for large datasets
Maximum date range	90 days (default), 180 days (add-on retention)	90 days (default), 180 days (add-on retention)
Export format	CSV (single or multiple files)	CSV (single file with paging)
Requires software	Web browser only	Exchange Online PowerShell module
Filtering granularity	High (workload, activities, users, date)	High (Operations, users, date, IP address)
Record limit per export	50,000 per CSV file	Unlimited with ResultSize parameter

Both methods export the same audit data. Choose the Purview web UI for quick investigations. Use PowerShell when you need to automate the export on a schedule, such as every Monday morning for the previous week’s logs.

You can now export Copilot audit logs from Purview using either the web interface or PowerShell. Start with a short date range to confirm the logs are captured, then expand the range for full coverage. For ongoing compliance monitoring, set up a PowerShell script that runs weekly and saves the CSV to a secured network share. If you need to retain logs beyond 90 days, configure audit log retention in Purview under Audit retention policies.