Microsoft Purview Audit logs record every action that Copilot takes in Microsoft 365 services. Without these logs, administrators cannot verify how Copilot accesses data or which files it processes. This article explains how to search and interpret Copilot activity events in Purview Audit. You will learn the exact search queries, the required permissions, and how … Read more
You have enabled Microsoft Purview auditing for your Microsoft 365 tenant, but the audit log does not display any Copilot prompt events. This means you cannot track what users are asking Copilot or which data sources Copilot is accessing. The root cause is typically that the Copilot-specific audit schema is not enabled or that the … Read more
You need to export Copilot audit logs from Microsoft Purview to track how users interact with Copilot across Microsoft 365. Audit logs record every Copilot action, including prompts, generated responses, and accessed data sources. Microsoft Purview is the only official tool that captures these logs with full detail. This article explains how to search, filter, … Read more
When you export audit logs from Microsoft 365 Purview to review Copilot interactions, the exported CSV or JSON file may contain metadata like timestamps and document names but show empty cells or null values for the actual user prompts. This makes it impossible to verify what users typed, what Copilot replied, or which grounding data … Read more
When your organization uses Microsoft Copilot, users generate prompts that interact with Microsoft 365 data. Legal or compliance teams often need to locate specific prompts during investigations or audits. Microsoft Purview eDiscovery can capture and search these prompts if your tenant has the correct licensing and audit logging enabled. This article explains how to configure … Read more
When your organization runs an eDiscovery search in Microsoft Purview, you expect all relevant data to appear in the results. But many administrators find that Copilot chat content is completely missing from search results, even when the search parameters should include it. This happens because Copilot interactions are stored in a separate, hidden mailbox that … Read more
If you use the Copilot Content Explorer in Microsoft 365, you might see public files that should not appear in your search results. This happens when Copilot indexes content from SharePoint sites or OneDrive folders that are shared broadly with Everyone or Everyone except external users. The result is a cluttered view that includes files … Read more
Official documentation checked October 14, 2026. Verify Copilot retention in the compliance system, not by asking the assistant whether it remembers a deleted file. A missing answer does not prove permanent deletion, and a visible answer does not by itself prove that a retention rule failed. There are two separate questions: whether the source documents … Read more
Official documentation checked October 14, 2026. If Copilot chats remain visible after a retention policy is created, do not immediately shorten the retention period or delete and recreate the policy. First distinguish policy coverage, deployment status, retention versus deletion, and what the user interface shows. This guide concerns organizational Microsoft 365 Copilot interaction data, not … Read more