What it does

Copilot prompts and responses are captured as Microsoft 365 activity, so they show up in Purview Audit, are discoverable in eDiscovery, retainable under retention policies, and reviewable in Communication Compliance.

Key facts

• Copilot interactions are logged in the unified audit log and stored in the user's mailbox, which is what makes them discoverable and retainable.
• eDiscovery (Standard and Premium) can search, hold and export Copilot prompts and responses.
• Retention and deletion policies apply to Copilot interaction data like other mailbox content.
• Communication Compliance can scan Copilot prompts and responses for policy breaches, harassment, sensitive-info leakage and the like.

When to use / skip

If you're in a regulated sector, this is what lets you say yes to Copilot. Turn it on and evidence it before go-live. Skip only if you've no compliance obligations at all, which is rare.

Configuration decisions

• Retention duration for Copilot interactions, aligned to your existing schedule.
• Whether Communication Compliance policies cover Copilot from day one.
• Who has eDiscovery and audit search roles, and whether that's least-privilege.

Gotchas

• Audit capture depends on the right licence tier and on audit being enabled, don't assume it's on. Verify a test prompt appears in the log before you certify the control.
• Prompts and responses landing in the mailbox surprises people during eDiscovery. Brief legal so it's not a shock in the first matter.
• Retention on Copilot data can interact awkwardly with mailbox retention. Test the deletion behaviour rather than assuming.

Consultant notes

• For regulated clients, prove audit and eDiscovery capture with a live test before the go/no-go. A screenshot of a Copilot prompt in the audit log settles the compliance debate quickly.
• Get Communication Compliance scoped early, it's the control reviewers ask about and the one most often forgotten.
• Data residency of this stored interaction data matters for EU clients, tie it back to the EU Data Boundary conversation.

---

Review when Purview support for Copilot data changes.