Copilot and Optional Data Collection

Data Collection → Copilot and Optional Data Collection

Copilot Events

Config flag: Copilot. Off by default. Enabling it subscribes the importer to the Audit.General feed; no Entra permission beyond the existing ActivityFeed.Read is needed.

Element	Description
Copilot audit records	Date, user, app host, agent and audit-derived credit estimate; a record is not necessarily a new conversation or unique turn. Released turn-aware queries pair supported runtime duplicates and exclude maker testing from agent adoption. See turn counting, including 1854's removal of timing-only suppression.
Files involved with copilot	File name, extension, URL, and site.
Meetings involved with copilot	Meeting name and ID.
Accessed resources	Resource ID, name, site URL, type, and sensitivity label.
AI models used	Model name (e.g. deep reasoning models).
Response messages	Message ID per copilot interaction.

Stable build 1807 additionally persists several fields the importer previously parsed and discarded: every interaction context (not just the first file or meeting), AI system plugins, accessed-resource actions, prompt messages and message sizes, thread ID, client region, Copilot log version, and AI model provider/version. Rows imported earlier are not filled in — Management Activity API content is only retrievable for 7 days, so these are populated for newly imported interactions only and existing rows keep NULL. See Copilot → Fuller audit-field capture. The optional Copilot audit backfill (Preview) doesn't change that: it imports Copilot interactions that are missing, from up to 180 days back, and skips those already in the database with their Copilot details, so it doesn't fill these fields in.

Recovering optional file and meeting enrichment

Since Stable 1856 (PR #768). A transient Graph failure (throttling, a server error or timeout) no longer permanently leaves a saved interaction without its optional resource details. Before falling back to chat-only storage, the importer records the event ID and retry state only in AnalyticsState / CopilotEnrichment, using the existing Storage account and runtime permissions. It does not copy the audit payload, user name or file URL into the queue.

The importer retries due work before each enabled audit-import cycle, including cycles with no new content. A pass considers at most 25 items, resolves one resource at a time, and stops starting new work after two minutes; an already-running bounded Graph/SQL operation may finish later. Failures back off from two minutes to at most six hours. An abandoned lease expires after ten minutes. A restart does not discard the queue, and a replay after SQL committed does not duplicate the resource link or rewrite the interaction's agent, cost or other core evidence.

ResolveCopilotResourceMetadata=False suspends this work without deleting it. Current user scope is checked again, and a purged/expired audit event is not recreated. A definite Graph no-result, such as a missing resource or denied meeting access, is reported rather than retried indefinitely; malformed, missing or over-1-MiB retained event data is reported as unrecoverable. This repairs newly queued failures, not every older unenriched interaction.

Storage failure is not a successful fallback: if the retry cannot be saved, the source audit batch fails and keeps its checkpoint for replay. Without Storage, a transient enrichment failure also fails the batch instead of silently losing the retry. Check Table access or deliberately disable optional resource resolution. HTML proxy 5xx responses retain their HTTP status for this decision; they are not treated as a permanent metadata miss. See runtime-state recovery rules.

Copilot usage reports (optional)

Config flag: GraphCopilotUsageReports. Off by default. Needs Reports.Read.All. Global cloud only.

Microsoft's own official Copilot usage figures — the same ones the Microsoft 365 admin centre shows — pulled from Graph rather than inferred from the audit feed. Three reports: a user-count summary, a user-count trend, and per-user usage detail.

Element	Description
Copilot user counts	Enabled and active user counts per app and date.
Per-user Copilot usage detail	Per user and date: last activity date per Copilot app, and prompt counts per app on report version 2.

Copilot AI interaction history (optional)

Config flag: CopilotInteractionHistory. Off by default. Needs AiEnterpriseInteraction.Read.All — explicit admin consent, not granted by the installer.

Copilot prompt history. Prompt and response text are never stored.

Element	Description
Interaction statistics	Per interaction: body character and word counts, attachment / link / mention / context counts, response latency, app class, conversation type, locale, device, timestamp.
Language, sentiment, keywords	Only when Cognitive Services is configured. A detected language, a positive-sentiment confidence (0.0–1.0), and extracted keywords.

Privacy. Optional Azure AI Language receives prompt text and stores derived keywords, which can contain a short prompt. Foundry categorisation is a separate durable opt-in data flow; leaving Language unconfigured does not disable it. Review prompt-content governance and scope/cap the history import.

Optional prompt categories

Interaction-history user prompts only can be classified against an immutable administrator taxonomy. The model receives bounded/truncated text in capped batches; stored facts are category/version and optional administrator-assigned Directing/Supervising labels, not raw prompts or model rationale. These are not a Work Trend Index survey score or O*NET mapping, and accuracy is not established by mocked tests.

No audit text is used, and Copilot Studio conversations are excluded by the history API. Prior discarded, failed/capped prompts are not automatically retried or recategorised. Aggregate mix/trend reporting requires ten distinct people per shown group. See Prompt categories for processing/retention/cost caveats and immediate importer-pause controls.

DLP impact on Copilot

No extra permission and no extra toggle — this works with the Copilot import you already have on.

Microsoft Purview DLP policies can stop Copilot using content. DLP policies scoped to the "Microsoft 365 Copilot and Copilot Chat" location do not emit records on the separate DLP.All audit feed; a Copilot block is reported inside the CopilotInteraction record instead. Those records are therefore the only source that can attribute a DLP block to a specific agent.

Element	Description
Copilot DLP matches	Per (resource × policy × rule) on an interaction: policy, rule (with severity and rule mode), action, affected resource name/type, sensitivity label, and whether the user was actually blocked or the rule merely audited. Carries the agent and user, via copilot_chats.
Tenant-wide DLP rule matches (optional — ImportDlp + ActivityFeed.ReadDlp)	Exchange, SharePoint/OneDrive and endpoint rule matches from the DLP.All feed: policy, rule, action, blocked flag. No agent identity — these records carry the literal UserKey = "DlpAgent", so they are never combined with the Copilot figures.

Blocked is not the same as "a policy matched". A rule can list BlockAccess and still block nothing because it is running in simulation (RuleMode = "Audit only"). The two are reported separately and never merged.

Privacy. The solution records that a policy fired — policy, rule, severity, action, and the affected resource's name and sensitivity label — and never the content that triggered it. It deliberately does not request the separate "Read DLP policy events including sensitive details" permission.

Agent costs (optional)

Config flags: CopilotStudioCredits and AzureCostManagement. Both off by default, and each needs its own extra grant that the installer deliberately does not make for you.

Two separate imports from two different Microsoft APIs. See Agent costs for the full setup.

Element	Description
Copilot Studio credits, per agent (delegated connection)	Derived from permitted per-user/resource consumption, grouped by agent/environment/day/billing slice. Current billing-feature/harness evidence is shown; the schema's model/tool/channel columns do not mean Microsoft supplied those values.
Copilot Studio credits, per person (same delegated reads; See PII to view)	Attributed credits and directory resolution where possible. Unresolved people remain counted. Stored person rows follow import scope; agent/billing reads remain tenant-wide.
Copilot Studio credit capacity (app-only Reader)	Entitled/consumed/allocated/available/pay-as-you-go/status snapshots. Copilot Studio capacity, not Cowork funding or rollout headroom.
Azure costs (needs Cost Management Reader on each scope)	Daily Azure spend for the scopes and meters you point it at: subscription, resource, resource group, service, meter category/sub-category/name, cost, currency, quantity, and whether the figure is still an estimate.

Azure costs have no user attribution, and never can. Azure bills by resource — no Azure billing report, including the full cost export, records who caused a charge.

Microsoft Cowork's usage has no API, so it can't be imported here; Copilot Adoption counts Cowork interactions from the Copilot audit log instead. Its pay-as-you-go spend does reach Azure, under the same Microsoft Copilot Studio service as Copilot Studio and Work IQ API, so the Azure costs import includes it, and can show it on its own once you separate it. See Agent costs → Microsoft Cowork.

Power Platform Adoption Events

Adoption-signal events for the Power Platform stack, read from both the legacy PowerApps/MicrosoftFlow audit workloads and the unified PowerPlatform admin activity feed (RecordType=256). No additional permissions are required beyond ActivityFeed.Read.

Prerequisite — Power Platform auditing must be turned on. Review the checklist: tenant Purview audit and the required environment/workload configuration. Power BI/Fabric uses the tenant Purview audit log; there is not a separate Power BI toggle to enable in this guide.

Element	Description
Power Apps launches	App ID, app name, environment, session ID, client type (Web/Mobile/Teams/etc.).
Power Apps shares	App, recipient user, role granted.
Power Automate flow runs	Flow ID, flow name, environment, run ID.
Power Automate flow shares	Flow, recipient user, role granted.
Power BI activity	Workspace, report (with report type), and dashboard for adoption-relevant events such as ViewReport.
Copilot Studio bot events	Bot ID, name, environment.
Connectors used by apps/flows	Connector name, publisher, premium flag, with junction tables linking apps and flows to the connectors they use.

Sent Email (optional)

A new opt-in importer reads each user's sentitems folder via Microsoft Graph. Disabled by default; enable by adding SentEmails=True to the ImportJobSettings app setting and granting the Mail.Read Graph application permission.

Element	Description
Sent emails	Sender, subject, sent timestamp, Graph message ID.
Recipients	One row per (message, recipient address) in sent_email_recipients.
Sentiment score	Optional positive-sentiment score from Azure AI Language when Cognitive Services is enabled.

Since Stable 1856 (PR #768): each mailbox read returns at most 1,000 messages per import cycle (200 when message bodies are read for sentiment scoring), so the first read of a large Sent Items folder is spread over several cycles and carries on where it stopped. A mailbox whose stored checkpoint Microsoft Graph rejects as expired is read again from the start, without importing any message twice, instead of no longer importing. See Usage reports and email troubleshooting → Sent emails.

Mailbox isolation, since Stable 1856 (PR #768). Each mailbox's message and recipient rows commit together, and only then does its checkpoint advance. A SQL or checkpoint failure for one mailbox no longer rolls back healthy mailboxes or prevents later mailboxes/chunks from running. The run still reports a failure after processing the others, so a partial import is not reported as fully successful. Failed mailboxes replay safely; an orphaned message can only have its recipients repaired from its owning mailbox, never another mailbox that returned the same Graph message ID.

---

Return to Data Collection · All topics in this guide