One of the most common questions about Copilot governance is: Where in Microsoft Purview can an administrator actually view Copilot prompts and responses? I know this because clients asked me on every Copilot engagement.
The answer is not as straightforward as many people expect. Most administrators quickly discover that the Purview Audit solution records Copilot activity. However, the audit log only captures metadata about an interaction such as who used Copilot, when the interaction occurred, and which Microsoft 365 workload was involved. It does not display the prompt or the response.
Different Purview modules surface varying levels of conversation detail. The easiest way to think about these experiences is to separate them into two categories. The first category focuses on activity-focused reporting, and these tell you that an interaction occurred:
- Audit
- Activity Explorer
The second category emphasizes content-focused reporting, and these allow you to review what was said during the interaction:
- DSPM
- Content Explorer
- Data Explorer
- eDiscovery
- Communication Compliance, for matched items only
- Insider Risk Management, for risky interactions only
Comparing Different Reporting Options
The table below summarizes these reporting options and how they compare. This covers Microsoft 365 Copilot (Premium), Copilot Chat (Basic), and agents built in the Microsoft ecosystem. Remember that like all things in Purview, licensing and role assignment contribute to your ability to use these modules and see data.
| Module | Prompt | Response | Purpose |
|---|---|---|---|
| DSPM | Yes | Yes | DSPM Activity Explorer is the investigation experience for Microsoft 365 Copilot and other supported AI applications. This is the only place in Purview to see all Copilot prompt and responses. |
| Content Explorer | When Matched | When Matched | Displays Copilot interaction content that has been prompts and responses matched with sensitive categories (SITs, Trainable Classifiers). It will not always show both the prompt and response, just if one or the other has a match. |
| Data Explorer | When Matched | When Matched | Similar to Content Explorer and the apparent successor to it. Adds sensitivity labels and retention labels to the filter on. Like Content Explorer, it does not show both the prompt and response but only if one matches the criteria. |
| eDiscovery | Yes | Yes | Searches retained Copilot interaction records stored as compliance records, making it the preferred solution for legal discovery, preservation, and export. |
| Communication Compliance | Yes | Yes | Displays only prompts and responses that match a configured Communication Compliance policy. Intended for policy-based investigations rather than general AI monitoring. |
| Insider Risk Management | Yes | Yes | Displays prompts and responses only when they contribute to risky AI usage indicators, alerts, or Insider Risk investigation cases. Also not intended for general AI monitoring. |
| Activity Explorer | No | No | Primarily an activity timeline that records AI interaction events and investigation metadata. Closer to viewing audit logs. |
| Audit | No | No | Records only metadata about Copilot usage, including the user, workload, operation, and timestamp. Conversation content is not included. |
Conclusion
Understanding these distinctions and considerations helps set expectations during investigations. If you simply need to determine whether a user interacted with Microsoft 365 Copilot, the audit log is usually sufficient. If you need to understand exactly what the user asked Copilot and what Copilot returned, you will need to use one of the content-focused modules.
Microsoft continues to expand its AI governance capabilities within Purview, which can be great but also means that this whole situation could shift over time. As Purview evolves and AI workloads are added, the boundaries between these tools and their specifics will likely continue to change.
Comments (0)