Skip to content

Confirm Copilot interactions are audited and searchable

Control
CR05
Kit
Copilot readiness
Area
Copilot audit and evidence
Priority
High
Effort
30 min
Last reviewed

Licence and role

Audit (Standard), included in Microsoft 365 business and enterprise plans. Longer audit retention needs Audit (Premium) or a retention add-on. Audit Logs or View-Only Audit Logs role.

Why it matters

When someone asks 'who saw this through Copilot?', the audit log is your only evidence. Copilot interactions are logged as part of Audit (Standard) under the CopilotInteraction record type, but only if auditing is on in your tenant. Check it before the pilot, not after the first incident.

Steps

  1. Run the read-only check: it confirms unified audit log ingestion is on and counts CopilotInteraction records in the last 7 days.
  2. If ingestion is off, turn it on in Microsoft Purview > Audit (a tenant change; allow up to 60 minutes).
  3. Microsoft Purview > Audit > search Activities - operation names: CopilotInteraction for one pilot user and save the search as your evidence procedure.
  4. Decide how long to keep Copilot audit records and Copilot interactions (audit log retention policy and Data Lifecycle Management retention for Copilot). Write the decision in the tracker.

Impact on users

Checking changes nothing. Turning on auditing has no user impact.

Rollback

Not needed for the check. Do not turn auditing off.

Read-only check

Reads settings only. It changes nothing in your tenant or on the device.

Modules, connection and role 
Requires: Microsoft.Online.SharePoint.PowerShell (SharePoint settings), ExchangeOnlineManagement (audit).
Connect first:
Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
Connect-ExchangeOnline
Note: Microsoft retires Search-UnifiedAuditLog on 15 Oct 2027 (MC1505599). CR05 will move to the Graph AuditLogQuery API before then.

Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled | Format-List | Out-String
$r = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -RecordType CopilotInteraction -ResultSize 1000
"CopilotInteraction records (last 7 days, max 1000): $(@($r).Count)"

How to verify

UnifiedAuditLogIngestionEnabled is True and a CopilotInteraction search for a pilot user returns results; the retention decision is recorded.

Sources

This control is in the M365 Copilot Readiness Kit

The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 24 controls.

Download the free Top 5 See the kit