Detailed Explanation of Microsoft Copilot Audit Record Types and Their Requirements

Question

Detailed Explanation of Microsoft Copilot Audit Record Types and Their Requirements

Louis 40

I would like a detailed explanation of the following Copilot audit record types:

CopilotInteraction
CreateCopilotPlugin
CreateCopilotPromptBook
CreateCopilotWorkspace
DeleteCopilotPlugin
DeleteCopilotPromptBook
DeleteCopilotWorkspace
DisableCopilotPlugin
DisableCopilotPromptBook
DisableCopilotWorkspace
EnableCopilotPlugin
EnableCopilotPromptBook
EnableCopilotWorkspace
Microsoft365CopilotScheduledPrompt
OutlookCopilotAutomation
UpdateCopilotPlugin
UpdateCopilotPromptBook
UpdateCopilotSettings
UpdateCopilotWorkspace

For each record type, please provide:

The action that triggers the audit event
The steps required to generate or populate audit data
The required roles (e.g., Admin, Maker, User)
The required licenses (e.g., Microsoft 365 E3/E5, Copilot licenses, capacity units)
Any additional prerequisites, such as Microsoft 365 configuration, Azure subscription, or other dependencies

I am looking for a clear, step-by-step explanation for each record type.

0 comments

1 answer

Your answer

Answer 1

Ashlesha Pawar (Tata Consultancy Services Limited) 75 Microsoft External Staff

Louis, Microsoft Copilot Audit Record Types — Quick Reference

1. CopilotInteraction

Trigger: User submits a prompt in any Copilot-enabled app (Word, Excel, Teams, Outlook, etc.)
Role: User
License: M365 Copilot
Note: Most common record. Logs interaction metadata; full content requires eDiscovery config.

2. CopilotPlugin Actions (Create / Update / Delete / Enable / Disable)

Trigger: Managing plugins in Copilot Studio
Role: Maker or Admin
License: Copilot Studio + Power Platform; Azure subscription if using external connectors

3. CopilotPromptBook Actions (Create / Update / Delete / Enable / Disable)

Trigger: Managing reusable prompt templates in the prompt library
Role: Maker or Admin
License: M365 Copilot; Power Platform may apply for org-wide sharing
Note: Used for enterprise prompt standardization.

4. CopilotWorkspace Actions (Create / Update / Delete / Enable / Disable)

Trigger: Managing collaborative Copilot environments
Role: Workspace Owner or Admin
License: M365 Copilot + E3/E5; Copilot Studio if building custom agents

5. Microsoft365CopilotScheduledPrompt

Trigger: A recurring Copilot prompt is created or auto-executes on schedule
Role: User or Admin
License: M365 Copilot (automation feature must be tenant-enabled)
Note: Common for daily summaries, weekly digests.

6. OutlookCopilotAutomation

Trigger: Copilot performs automated email processing (auto-triage, rule-based actions)
Role: User
License: M365 Copilot + Exchange Online

7. UpdateCopilotSettings

Trigger: Admin changes Copilot policies or configuration in M365 Admin Center / Purview
Role: Global/Copilot/Compliance Admin
License: M365 E3/E5 + Copilot

Ashlesha Pawar (Tata Consultancy Services Limited) 75 Reputation points Microsoft External Staff

2026-04-06T06:58:25.0133333+00:00

Louis just following up on the answer I shared earlier. I wanted to check if it helped resolve your question or if you need any further clarification—happy to expand on any part.

If everything looks good on your end, I’d appreciate it if you could mark the answer as accepted.
Louis 40 Reputation points

2026-04-06T11:36:24.7166667+00:00

@Ashlesha Pawar (Tata Consultancy Services Limited) I have performed all the listed actions. However, in Microsoft Purview, audit data is available only for the CopilotInteraction and Microsoft365CopilotScheduledPrompt record types. Audit data is not being generated for the other record types. Could you please help clarify why this is happening?
Ashlesha Pawar (Tata Consultancy Services Limited) 75 Reputation points Microsoft External Staff

2026-04-06T13:16:39.89+00:00

Louis, Based on our validation, audit logging is correctly configured in your tenant. The behavior you’re observing is expected.

At present, Microsoft Purview only surfaces a limited set of Microsoft Copilot audit record types, specifically CopilotInteraction and Microsoft365CopilotScheduledPrompt. Other record types such as plugin, prompt book, and workspace lifecycle events are not yet fully available in the Unified Audit Log.

These events may exist in backend telemetry or are part of ongoing feature rollout, but they are not currently exposed through Purview audit search.

Therefore, this is not a configuration issue, but a current product limitation. As a workaround, you may consider using Power Platform admin logs, role-based access controls, or other governance mechanisms depending on your scenario.

Please let us know if you would like guidance on alternative monitoring approaches.
Louis 40 Reputation points

2026-04-06T16:55:14.76+00:00

@Ashlesha Pawar (Tata Consultancy Services Limited) Yes, please guide me on the alternative monitoring approaches you mentioned. It would be helpful to understand how to monitor these activities effectively.
Ashlesha Pawar (Tata Consultancy Services Limited) 75 Reputation points Microsoft External Staff

2026-04-07T04:35:10.1966667+00:00
Louis Thanks for your question — since the required Copilot audit events are not currently available in Microsoft Purview, you can use the following alternative approaches to monitor these activities effectively:

1. Monitor Plugin / Prompt / Workspace Activity

These components are managed through Microsoft Copilot Studio (built on Power Platform).

You can track related activity via:

Power Platform Admin Center

Environment-level audit logs (solution changes, connector usage, etc.)

This is the closest available method to track plugin and workspace lifecycle operations.

2. Track Administrative and Access Changes

Use Microsoft Entra ID audit logs to monitor:

Role assignments

Application/service principal changes

Permission updates

Helps identify who performed administrative actions

3. Apply Governance via DLP Policies

Within Power Platform:

Configure Data Loss Prevention (DLP) policies

Control and monitor connector usage

While not direct audit logs, this provides control and indirect visibility over plugin behavior

4. Continue Using Purview for Available Events

Use Microsoft Purview to monitor:

CopilotInteraction

Microsoft365CopilotScheduledPrompt

This remains the primary source for user-level Copilot activity.

Share via

Detailed Explanation of Microsoft Copilot Audit Record Types and Their Requirements

1 answer

1. CopilotInteraction

2. CopilotPlugin Actions (Create / Update / Delete / Enable / Disable)

3. CopilotPromptBook Actions (Create / Update / Delete / Enable / Disable)

4. CopilotWorkspace Actions (Create / Update / Delete / Enable / Disable)

5. Microsoft365CopilotScheduledPrompt

6. OutlookCopilotAutomation

7. UpdateCopilotSettings

1. Monitor Plugin / Prompt / Workspace Activity

2. Track Administrative and Access Changes

3. Apply Governance via DLP Policies

4. Continue Using Purview for Available Events

Your answer