Extend Microsoft Copilot Audit Log Retention in Purview

Official documentation checked October 14, 2026.

Keeping Copilot conversation content and keeping its audit trail are different tasks. A Data Lifecycle Management policy for Exchange email does not extend the unified audit log. Use an Audit retention policy for audit records, and assess conversation retention separately.

This guide concerns organizational Microsoft 365 Copilot activity, not personal Microsoft Copilot chat history. Have the records owner approve the period and scope before changing tenant policy; a duration offered by the portal is not a legal compliance guarantee.

Understand the current audit defaults and licensing

Audit (Standard) retains current records for 180 days. Audit (Premium) provides a one-year default for eligible users’ Exchange, SharePoint, OneDrive, and Microsoft Entra activity. That is not a blanket one-year default for every workload: Copilot activity needs its own applicable policy if you want to extend the usual 180-day period. See Microsoft’s Audit capability overview.

For user activity beyond 180 days and up to one year, check the generating user’s qualifying E5 or Audit add-on entitlement. A tenant administrator’s license alone is not enough. Longer choices require additional licensing: Microsoft’s guidance requires the 10-year Audit Log Retention add-on with the specified E5 subscription for three-, five-, seven-, and ten-year retention. Confirm the exact licenses before approving the change. Do not choose three years merely because another organization uses it.

Create a policy for the correct Copilot records

1. Sign in to Microsoft Purview with the Organization Configuration role. Open Audit, then Create audit retention policy.
2. Enter a unique name and identify the approved users. A blank Users field means all users.
3. Choose the intended record type, duration, and priority. A blank record-type field means all types. Review the scope before saving.

These are Audit settings, not the Exchange email retain/delete wizard. Microsoft’s policy guide also explains that changes do not extend previously committed audit items. Do not promise retrospective protection.

For Microsoft 365 Copilot Chat, Microsoft’s examples use CopilotInteraction for both operation and record type. This type also covers other Copilot products, so inspect sample events and their AppIdentity before calling your coverage Microsoft-365-only. Facilitator and other AI activities can use different types. The Copilot audit schema is the reference for deciding which events your requirement includes.

If the required type is unavailable in the portal, use the documented New-UnifiedAuditLogRetentionPolicy workflow in Security & Compliance PowerShell. Its scope parameters are RecordTypes, Operations, and UserIds; do not substitute an Exchange workload simply to make the wizard proceed. Have an administrator review the proposed values before creation.

Check competing policies and verify the saved configuration

Custom audit policies override the default, even when shorter. A smaller priority number wins among applicable custom policies. This makes an existing short-duration rule an important check before adding another policy.

In an authorized Security & Compliance PowerShell session, this read-only command displays the custom policies in priority order:

Get-UnifiedAuditLogRetentionPolicy |
    Sort-Object Priority |
    Format-List Priority,Name,RecordTypes,Operations,UserIds,RetentionDuration

The Get cmdlet documentation describes the policy inspection command. The built-in default is not returned. Save the approved configuration and compare the relevant users, event types, duration, priority, and licenses with your requirements.

Run a harmless Copilot interaction with an in-scope test user and search Audit for its operation and time. Finding the new event proves collection, not that a multi-year retention interval has already been demonstrated. Schedule later checks against the expected retention boundary.

Investigate missing records without confusing them with transcripts

For an empty search, recheck the user, time range, operation, auditing status, and whether processing has completed. Search a known recent interaction before concluding that an old event was deleted. Do not repeatedly replace policies to troubleshoot ingestion.

Audit records contain activity metadata and message identifiers; do not expect invented PromptText and ResponseText fields to provide a complete transcript. Use the appropriate eDiscovery workflow when actual conversation content is required. Extending audit retention does not itself retain that content, and a mailbox litigation hold is not a substitute for an Audit retention policy.