Document the fuller Copilot audit-field capture, and correct the build number
The Copilot page described the usage-report and interaction-history imports but
nothing from the work that persists the audit fields the importer previously
parsed and threw away. Adds sections for interaction contexts (every context, not
just the first file or meeting) and AI system plugins, extends the accessed-
resource and database-table tables, and records the no-backfill consequence: the
Management Activity API only retains content for about 7 days, so these fields
populate for newly imported interactions only.
Also corrects a statement that is now wrong: prompt messages ARE imported (IDs and
sizes only, never text), where the page previously said user prompts are not
tracked.
Five pages cited "Stable build 1791" for the Copilot reporting work, the Teams
add-on removal and the interaction-history import. That build does not exist -
nothing was published between 1756 and 1807, because 1796 and 1806 were only ever
drafts. Corrected to 1807 throughout.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Document the Copilot usage report and interaction history imports
Stable build 1791 added two Graph-based Copilot imports and removed per-user
Teams apps tracking. None of it was in the wiki, and the pages still told admins
to grant a permission the product no longer uses and to set a config flag that no
longer exists.
New permission - the important one:
AiEnterpriseInteraction.Read.All, for the Copilot AI interaction history
(prompt history) import. Unlike every other permission the solution needs, the
installer does NOT request or grant this one - an Entra admin has to add it to
the runtime app registration and consent to it explicitly. It also needs the
M365_COPILOT_BUSINESS_CHAT service plan per user, and in practice a
UserGroupsFilter scope, because the endpoint is one HTTP call per user and an
unscoped run at the 200k-user design target means 200k calls per cycle.
Removed permission:
TeamsAppInstallation.ReadForUser.All is no longer used anywhere in the code
(verified) and can be revoked. It existed for the per-user Teams app-install
tracking this release removes.
Also corrected: GraphUserApps still appeared in the ImportJobSettings examples on
the manual-setup and troubleshooting pages, so anyone following them would have
configured a flag that no longer exists. The occurrence in Release Notes.md is a
quoted historical payload and is deliberately left alone.
Privacy is now stated explicitly rather than left to be inferred. Security Model
previously said "Nothing about your tenant leaves your environment", which is not
true once Cognitive Services is configured: prompt text is sent to Azure AI
Language, and while the text itself is not stored, the extracted keywords ARE -
and a keyword can amount to a whole short prompt. That claim is now qualified and
a "Copilot prompt content" section spells out the three states (import off,
import on without cognitive, import on with cognitive) and the three controls
that bound it.
Pages changed:
Prerequisites - permission table, plus a section on the three
prerequisites for interaction history
Configuration Reference - GraphCopilotUsageReports and CopilotInteractionHistory
flags; GraphUserApps marked removed; stale Redis key
Copilot - full sections for both new imports
Data Collection - what each import stores, and the removed-feature notice
Security Model - Copilot prompt content
Installation / Troubleshooting - stale ImportJobSettings examples
All cross-page anchors were verified to resolve against the real headings, and
the diff was scanned for GUIDs, tenant domains, SharePoint URLs and addresses -
none added.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 87347b97-407c-4dbe-bae5-e8880d0fc77d
Docs: Teams application access policy for Copilot meetings (#215) + Service Bus Premium in private deployments (#228)
- Copilot: new section explaining that OnlineMeetings.Read.All alone is not enough - a Teams
application access policy (New-CsApplicationAccessPolicy / Grant-CsApplicationAccessPolicy)
is also required, what the 403 looks like, and that only meeting metadata is affected.
- Prerequisites: OnlineMeetings.Read.All row now points at that section.
- Private Endpoints: new section on why the Teams calls import needs Service Bus on Premium in a
private deployment, the exact runtime error (which looks like an auth failure but is a network
block), the three valid options, and what the installer now does automatically.
Docs: remove outdated AITracker page and add Copilot Analytics documentation