When you export audit logs from Microsoft 365 Purview to review Copilot interactions, the exported CSV or JSON file may contain metadata like timestamps and document names but show empty cells or null values for the actual user prompts. This makes it impossible to verify what users typed, what Copilot replied, or which grounding data was used. The root cause is a default Purview audit logging configuration that excludes the message payload column from exports. This article explains how to adjust the export schema and which PowerShell command forces the inclusion of prompt text in your audit logs.
Key Takeaways: Recover Missing Copilot User Prompts in Audit Logs
- Purview Audit (Premium) license: Required to export the AuditData column containing user prompts. E5 or add-on license needed.
- Search-UnifiedAuditLog -ResultSize 5000 -SessionId “Export” | Export-Csv: PowerShell cmdlet that forces the AuditData column into the export.
- Purview portal > Audit > Search > Export > Export all results: Web UI method that exports only visible columns — does NOT include AuditData by default.
Why Copilot User Prompts Are Missing From Audit Log Exports
Microsoft 365 Purview Audit stores Copilot interactions in the AuditData column as a JSON object. This column contains the user prompt, the Copilot response, and the grounding documents used. When you export audit logs through the Purview web interface, the export function only includes the columns displayed in the search results grid. The AuditData column is hidden by default because it contains large JSON blobs that slow down the browser rendering.
The export format also matters. The CSV file generated by the web UI strips nested JSON fields. The JSON export preserves the AuditData column but many administrators do not select the JSON option. In both cases, the user prompt text is present in the raw data but is filtered out during the export process.
Licensing Requirement for AuditData Access
Only tenants with an Microsoft 365 E5 license or the Audit (Premium) add-on can export the full AuditData column. Tenants on E3 or Business Premium plans see a truncated version of AuditData that excludes the Copilot prompt content. If your tenant lacks the required license, the prompt text will always appear as null regardless of the export method.
Steps to Export Copilot Audit Logs With User Prompts
Use one of the two methods below. Method 1 uses the Purview web interface with JSON format. Method 2 uses PowerShell and is the only reliable way to get all prompt data in a single CSV file.
Method 1: Export to JSON From the Purview Portal
- Open Purview Audit Search
Go to the Microsoft Purview compliance portal at compliance.microsoft.com. Select Audit under Solutions. - Run a Copilot-Specific Search
Set the date range to cover the period with missing prompts. Under Activities, select Copilot interactions or type Copilot in the search bar. Click Search. - Change Export Format to JSON
After the search finishes, click Export at the top of the results pane. In the dropdown, choose Export all results in JSON format. Do not select CSV. - Open the JSON File
Open the downloaded .json file in a text editor or a JSON viewer. Each record contains an AuditData field. Inside that field, locate CopilotPrompt or UserPrompt to see the full prompt text.
The JSON method preserves the AuditData column. The downside is that JSON files are harder to analyze in Excel without a flattening script.
Method 2: Export With PowerShell Including AuditData Column
This method forces the AuditData column into a CSV export. It works with Audit (Premium) licenses only.
- Connect to Exchange Online PowerShell
Open Windows PowerShell as Administrator. Run Connect-ExchangeOnline and sign in with a Global Admin or Compliance Admin account. - Run the Audit Log Search Cmdlet
Execute the following command. Replace the StartDate and EndDate values with your target range.Search-UnifiedAuditLog -StartDate "2025-01-01" -EndDate "2025-01-31" -ResultSize 5000 -SessionId "CopilotExport" -Operations "CopilotInteraction" | Export-Csv -Path "C:\Audit\CopilotAudit.csv" -NoTypeInformation - Verify the Export Contains Prompt Data
Open the CSV file in Excel. Look for the AuditData column. Each cell contains a JSON string. Use Excel’s From JSON query in Power Query to parse the prompt field into a readable column. - Increase Result Size If Needed
If you have more than 5000 records, run the same command with a smaller date range and use the -SessionId parameter to resume from the last record. The session ID ensures no duplicates.
If Copilot Prompts Are Still Missing After the Export
Copilot Audit Log Shows No Results at All
If the audit search returns zero records, Copilot audit logging might be disabled. Go to Purview > Audit > Audit log and verify that audit logging is turned on. If it is off, click Start recording user and admin activity. Wait up to 24 hours for new Copilot interactions to appear.
CopilotInteraction Operation Name Not Appearing in Search
The CopilotInteraction operation name was added in late 2024. If you are searching for older records, use WorkplaceAnalytics or SubstrateSearchQuery as the operation name. Those older operations also contain Copilot prompt data but under different field names. In the AuditData JSON, look for QueryText instead of CopilotPrompt.
AuditData Column Shows Null in PowerShell Export
If the AuditData column contains the string “null” or is empty, the tenant does not have Audit (Premium) licensing. Verify your license by running Get-OrganizationConfig | fl AuditLogAgeLimit. If the value is 90 days, you have standard audit. If the value is 365 days or higher, you have Audit (Premium). Upgrade to E5 or purchase the Audit (Premium) add-on to restore full prompt data.
Purview Web Export vs PowerShell Export: AuditData Handling
| Item | Purview Web UI Export | PowerShell Export |
|---|---|---|
| Default format | CSV (grid columns only) | CSV with all columns including AuditData |
| AuditData column included | Only in JSON format | Always included |
| User prompt visibility | Hidden in CSV, present in JSON | Present as JSON string in CSV |
| License requirement | E5 or Audit Premium for full AuditData | E5 or Audit Premium for full AuditData |
| Best for analysis | Quick browser review | Power Query or script-based parsing |
The web UI JSON export works for one-time checks. The PowerShell export is better for recurring compliance reports because it preserves the AuditData column in a machine-readable format.
You can now export Copilot audit logs with full user prompt text using either the Purview JSON export or the PowerShell method. Start by verifying your Audit Premium license status. If you have the required license, use the PowerShell command with the -Operations “CopilotInteraction” filter to get the most complete dataset. For daily automated exports, schedule the PowerShell script as a task and use Power Query to flatten the AuditData JSON into separate columns for user prompt, Copilot response, and grounding documents.