Microsoft Purview Audit logs record every action that Copilot takes in Microsoft 365 services. Without these logs, administrators cannot verify how Copilot accesses data or which files it processes. This article explains how to search and interpret Copilot activity events in Purview Audit. You will learn the exact search queries, the required permissions, and how … Read more
You have enabled Microsoft Purview auditing for your Microsoft 365 tenant, but the audit log does not display any Copilot prompt events. This means you cannot track what users are asking Copilot or which data sources Copilot is accessing. The root cause is typically that the Copilot-specific audit schema is not enabled or that the … Read more
You need to export Copilot audit logs from Microsoft Purview to track how users interact with Copilot across Microsoft 365. Audit logs record every Copilot action, including prompts, generated responses, and accessed data sources. Microsoft Purview is the only official tool that captures these logs with full detail. This article explains how to search, filter, … Read more
When you export audit logs from Microsoft 365 Purview to review Copilot interactions, the exported CSV or JSON file may contain metadata like timestamps and document names but show empty cells or null values for the actual user prompts. This makes it impossible to verify what users typed, what Copilot replied, or which grounding data … Read more
When your organization uses Microsoft Copilot, users generate prompts that interact with Microsoft 365 data. Legal or compliance teams often need to locate specific prompts during investigations or audits. Microsoft Purview eDiscovery can capture and search these prompts if your tenant has the correct licensing and audit logging enabled. This article explains how to configure … Read more
When your organization runs an eDiscovery search in Microsoft Purview, you expect all relevant data to appear in the results. But many administrators find that Copilot chat content is completely missing from search results, even when the search parameters should include it. This happens because Copilot interactions are stored in a separate, hidden mailbox that … Read more
If you use the Copilot Content Explorer in Microsoft 365, you might see public files that should not appear in your search results. This happens when Copilot indexes content from SharePoint sites or OneDrive folders that are shared broadly with Everyone or Everyone except external users. The result is a cluttered view that includes files … Read more
Microsoft 365 administrators need to verify that Copilot does not surface data that should be deleted or held under a retention policy. Copilot generates responses by grounding itself in Microsoft Graph data, which includes emails, documents, and chat messages. If a retention policy is misconfigured or Copilot bypasses it, sensitive expired data could appear in … Read more
When you set a retention policy in Microsoft 365 Purview, you expect it to apply to all Copilot interactions, including chat history. However, many administrators report that the policy does not affect Copilot chats in Microsoft Teams or the Copilot pane. This happens because Copilot chat data is stored in a separate hidden mailbox folder … Read more