Microsoft Copilot eDiscovery: How to Hold Copilot Conversations
🔍 WiseChecker

Microsoft Copilot eDiscovery: How to Hold Copilot Conversations

Legal and compliance teams often need to preserve Copilot conversations for eDiscovery or regulatory review. When Copilot generates responses in Microsoft 365 apps, those interactions can become discoverable electronic records. The challenge is that Copilot conversations are not automatically preserved in all data sources. This article explains how to place a legal hold on Copilot conversations using Microsoft Purview eDiscovery. You will learn the specific settings required to capture Copilot interactions as part of your hold policy.

Key Takeaways: Preserving Copilot Conversations for eDiscovery

  • Microsoft Purview eDiscovery > Legal hold settings > Content query: Defines the scope of data preserved, including Copilot interactions stored in Exchange Online and SharePoint Online.
  • Copilot conversation data location: Copilot responses are stored in the user’s Exchange Online mailbox as items in the Purview Messages folder, not in standard email folders.
  • Retention policy vs legal hold: A retention policy preserves data for a set period; a legal hold preserves data indefinitely until the hold is released, which is required for active litigation.

Why Copilot Conversations Are Discoverable and How They Are Stored

Microsoft Copilot conversations are not separate files. When a user asks Copilot a question in Word, Excel, PowerPoint, or Outlook, the prompt and the generated response are stored in the user’s Exchange Online mailbox. Specifically, each Copilot interaction is saved as an email-like item in the Purview Messages folder, a hidden system folder within the mailbox. This folder is not visible in Outlook or Outlook on the web, but eDiscovery tools can search and preserve its contents.

The same data is also replicated in the user’s SharePoint Online OneDrive for Business site under a hidden folder named CopilotInteractions. This dual storage ensures that Copilot conversations are captured even if the mailbox is excluded from a hold. However, the default eDiscovery hold does not automatically include these folders. You must configure the hold query to target them explicitly.

Which Copilot Conversations Are Captured

Only conversations initiated after the hold is applied are preserved. Existing conversations before the hold date are not retroactively captured unless you also apply a retention policy. The hold covers all Copilot interactions across Microsoft 365 apps where the user is signed in with a work or school account. Personal Microsoft accounts are not included.

Conversations in Microsoft Teams with Copilot are stored differently. Teams Copilot interactions are saved as part of the Teams chat history in the user’s Exchange Online mailbox, specifically in the Conversation History folder. To preserve Teams Copilot conversations, you must include the Teams chat data source in the hold query.

Steps to Place a Legal Hold on Copilot Conversations

These steps assume you have the required permissions: eDiscovery Manager or eDiscovery Administrator role in Microsoft Purview. You also need a Microsoft 365 E5 or E5 Compliance license for the users you place on hold.

  1. Open Microsoft Purview compliance portal
    Go to https://compliance.microsoft.com and sign in with your admin credentials. Select eDiscovery from the left navigation pane, then choose Standard or Premium depending on your license. For this task, Standard is sufficient.
  2. Create a new eDiscovery case
    Click Create a case. Enter a name for the case, such as “Copilot Conversation Hold — Q1 2025.” Add a description and select the appropriate member permissions. Click Save to create the case.
  3. Open the case and create a hold
    Click the case name to open it. Under the Holds tab, click Create. The hold wizard opens.
  4. Name the hold and specify locations
    Enter a name for the hold, for example “Copilot Conversations Hold.” In the Locations step, toggle Exchange mailboxes to On. This includes all user mailboxes. If you need to hold only specific users, click Choose users, groups, or teams and add the relevant accounts.
  5. Include SharePoint and OneDrive locations
    Toggle SharePoint sites to On. This includes all SharePoint Online site collections and OneDrive for Business sites. To narrow the scope, click Choose sites and enter specific site URLs. Copilot interactions stored in OneDrive are covered under this location.
  6. Configure the content query to target Copilot data
    In the Query step, select Add a query. In the keyword box, enter the following query to capture Copilot conversations across all held locations:

    itemclass:IPM.Note.Copilot.Interaction OR itemclass:IPM.SkypeTeams.Copilot.Message

    This query targets the specific item classes used by Copilot in Exchange Online and Teams. For SharePoint and OneDrive, add a second line:

    path:"/CopilotInteractions"

    Click Add to apply the query.

  7. Set the hold duration
    In the Settings step, under Hold duration, select Hold indefinitely for litigation holds. If you need a time-bound hold, select Specify number of days and enter the duration. Click Next.
  8. Review and create the hold
    Review the locations, query, and settings. Click Submit. The hold may take up to 24 hours to fully apply to all mailboxes and sites.

If Copilot Conversations Are Not Appearing in eDiscovery Search Results

Hold Query Excludes the Correct Item Class

The most common reason Copilot conversations are missing is that the content query does not include the correct item class. Verify that the query contains itemclass:IPM.Note.Copilot.Interaction. If you are using a custom query, test it by running a search in the eDiscovery case before creating the hold. Go to the Searches tab, create a new search, paste the query, and run it. If results return zero items, adjust the query.

Copilot Conversations Were Created Before the Hold Was Applied

Legal holds only preserve data from the moment the hold is active. Conversations generated before the hold date are not retroactively captured. To preserve older conversations, apply a retention policy with a retention period that covers the date range you need. In Microsoft Purview, go to Data Lifecycle Management > Microsoft 365 > Retention policies. Create a policy with the same query and locations, and set the retention period to cover the required time frame.

User Mailbox Is Not Included in the Hold

If you selected specific users instead of all mailboxes, double-check that the user who generated the Copilot conversations is included. Open the hold, go to the Locations tab, and verify the user appears in the list. If not, edit the hold and add the user.

Legal Hold vs Retention Policy: Key Differences for Copilot Data

Item Legal Hold Retention Policy
Purpose Preserve data for active litigation Retain data for a defined period for compliance or regulatory needs
Duration Indefinite until hold is released Fixed number of days or years
Retroactive coverage No — only data created after hold is applied Yes — can cover data created before the policy was created if configured
Data deletion prevention Prevents permanent deletion of preserved items Does not prevent deletion; only retains copies
Required license Microsoft 365 E5 or E5 Compliance Microsoft 365 E3 or higher
Copilot data coverage Requires explicit item class query Requires explicit item class query

For active litigation, always use a legal hold. Use a retention policy for routine compliance archiving. You can apply both simultaneously, but the legal hold takes precedence if a conflict arises.

You can now place a legal hold on Copilot conversations using the correct item class query and location settings. Verify the hold by running a test search before relying on it for discovery. As an advanced tip, export the hold query as a JSON file and reuse it across multiple cases to save time. This approach ensures consistent coverage of Copilot interactions across your organization.