Microsoft Purview Audit Does Not Show Copilot Prompt Events: Fix

You have enabled Microsoft Purview auditing for your Microsoft 365 tenant, but the audit log does not display any Copilot prompt events. This means you cannot track what users are asking Copilot or which data sources Copilot is accessing. The root cause is typically that the Copilot-specific audit schema is not enabled or that the required license is missing. This article explains the exact license and configuration steps to make Copilot prompt events appear in Purview Audit.

Why Copilot Prompt Events Do Not Appear in Purview Audit

Microsoft Purview Audit logs user activity across Microsoft 365 services. Copilot prompt events are part of the Audit (Premium) schema, not the standard Audit (Basic) logging. If your tenant uses Audit (Basic) or has an E3 license, the Copilot events are not collected.

The specific audit event names for Copilot are CopilotInteraction and CopilotResponse. These events contain the user prompt and the data sources Copilot accessed. For these events to appear, the tenant must have one of the following licenses: Microsoft 365 E5, A5, or a standalone Microsoft 365 E5 Compliance add-on. Additionally, the Purview Audit (Premium) feature must be enabled at the tenant level.

If you have the correct license but still see no events, the Copilot audit schema is likely not activated. Microsoft requires a one-time PowerShell command to register the schema. Without this command, Purview does not map the Copilot events to the audit log.

Steps to Enable Copilot Prompt Events in Purview Audit

1. Verify the required license
   Open the Microsoft 365 admin center at admin.microsoft.com. Go to Billing > Licenses. Confirm each user who uses Copilot has a Microsoft 365 E5, A5, or E5 Compliance add-on license. If users have only E3 or Business Premium, upgrade their license. Without the correct license, Purview will not log Copilot events.
2. Enable Purview Audit (Premium)
   In the Microsoft Purview compliance portal at compliance.microsoft.com, go to Audit > Audit solutions. Under Audit (Premium), click Settings. Toggle Record activity for all users to On. This turns on the Premium schema that includes Copilot events.
3. Activate the Copilot audit schema with PowerShell
   Open Windows PowerShell as an administrator. Run the following command to install the Exchange Online Management module if you have not already:
   Install-Module -Name ExchangeOnlineManagement
   Then connect to Exchange Online:
   Connect-ExchangeOnline -UserPrincipalName admin@yourtenant.onmicrosoft.com
   Finally, run the command that registers the Copilot event schema:
   Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
   Wait 5 to 10 minutes for the schema to propagate.
4. Verify the Copilot events in the audit log
   In the Purview portal, go to Audit > Audit log. Set the date range to the last 24 hours. In the Activities field, search for CopilotInteraction or CopilotResponse. If no results appear, run a Copilot query from a user account and then refresh the audit log after 30 minutes.
5. Check the audit retention policy
   Go to Audit > Audit retention policies. Ensure the policy includes the workload Copilot. If Copilot is not listed, create a new retention policy. Set the retention period to 90 days or longer as needed. Without a retention policy, events may be deleted before you can view them.

If Copilot Events Still Do Not Appear After the Main Fix

Copilot interaction events show as empty or null

This happens when the audit log captures the event but does not record the user prompt. The cause is a delay in the Copilot backend service. Wait up to 24 hours for the full event data to populate. If the data remains null, open a support ticket with Microsoft and include the AuditEventId from the log.

Audit log shows only CopilotResponse events, not CopilotInteraction

This indicates that the Copilot schema is partially enabled. Run the PowerShell command again: Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true. Then restart the Exchange Online Management session. After the restart, force a new Copilot query from a test user. Check the log again after 30 minutes.

No Copilot events at all despite correct license

The Purview Audit (Premium) feature may be turned off for specific users. In the Purview portal, go to Audit > Audit solutions > Audit (Premium) > Settings. Under Users, verify that the users who use Copilot are included. If they are excluded, add them to the included list. Also confirm that the audit log is not filtered by workload. In the Activities field, clear all filters and search for Copilot.

Item	Audit (Basic)	Audit (Premium)
License required	E3, Business Premium, or equivalent	E5, A5, or E5 Compliance add-on
Copilot events logged	No	Yes
Retention period	90 days	1 year (extendable to 10 years)
Schema activation needed	No	Yes, via PowerShell
Event detail level	Basic metadata only	Full prompt text and data source list

After completing the steps above, you can now view Copilot prompt events in the Purview audit log. Use the CopilotInteraction event to track user prompts and the CopilotResponse event to see which data sources Copilot accessed. For ongoing monitoring, set up an audit alert for the Copilot workload in the Purview portal. This lets you receive email notifications when a user sends a high-risk prompt to Copilot.