You configured a Data Loss Prevention policy in the Microsoft 365 Purview compliance portal, but Copilot still returns content that contains credit card numbers, social security numbers, or other sensitive information. This problem usually occurs because the DLP policy does not include the Copilot workload or because the policy uses a detection rule that Copilot … Read more
You apply a sensitivity label to a SharePoint file to restrict access or prevent Copilot from reading it. But Copilot still summarizes, rewrites, or references the file in its responses. This happens because Copilot reads files based on SharePoint permissions and Microsoft Graph indexing, not solely on the label’s encryption or marking settings. The label … Read more
You ask Copilot a question in Microsoft Teams chat, and the response includes a file that your organization has labeled as Confidential. This exposes sensitive data to users who should not see it. The root cause is a gap between how Microsoft Purview Information Protection sensitivity labels are applied and how Copilot interprets its data … Read more
You open a document protected by a Microsoft Purview Information Protection sensitivity label, such as Confidential or Highly Confidential, and ask Copilot to summarize the content or draft a reply based on it. Instead of returning the expected output, Copilot either refuses to act on the document, returns a generic error message, or skips the … Read more
Microsoft Purview Audit logs record every action that Copilot takes in Microsoft 365 services. Without these logs, administrators cannot verify how Copilot accesses data or which files it processes. This article explains how to search and interpret Copilot activity events in Purview Audit. You will learn the exact search queries, the required permissions, and how … Read more
You have enabled Microsoft Purview auditing for your Microsoft 365 tenant, but the audit log does not display any Copilot prompt events. This means you cannot track what users are asking Copilot or which data sources Copilot is accessing. The root cause is typically that the Copilot-specific audit schema is not enabled or that the … Read more
You need to export Copilot audit logs from Microsoft Purview to track how users interact with Copilot across Microsoft 365. Audit logs record every Copilot action, including prompts, generated responses, and accessed data sources. Microsoft Purview is the only official tool that captures these logs with full detail. This article explains how to search, filter, … Read more
When you export audit logs from Microsoft 365 Purview to review Copilot interactions, the exported CSV or JSON file may contain metadata like timestamps and document names but show empty cells or null values for the actual user prompts. This makes it impossible to verify what users typed, what Copilot replied, or which grounding data … Read more
When your organization uses Microsoft Copilot, users generate prompts that interact with Microsoft 365 data. Legal or compliance teams often need to locate specific prompts during investigations or audits. Microsoft Purview eDiscovery can capture and search these prompts if your tenant has the correct licensing and audit logging enabled. This article explains how to configure … Read more
When your organization runs an eDiscovery search in Microsoft Purview, you expect all relevant data to appear in the results. But many administrators find that Copilot chat content is completely missing from search results, even when the search parameters should include it. This happens because Copilot interactions are stored in a separate, hidden mailbox that … Read more